Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2023-45648 — Improper Input Validation in Apache Tomcat

CWE-20 — Improper Input Validation13 documents11 sources
Severity
5.3MEDIUMNVD
EPSS
59.5%
top 1.75%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Apache TomcatApache Software Foundation Apache TomcatDebian Linux
Timeline
PublishedOct 10
Latest updateJun 9

Description

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/tomcat8.5.0 — 8.5.94+5
▶CVEListV5apache_software_foundation/apache_tomcat11.0.0-M1 — 11.0.0-M11+3

Also affects: Debian Linux 10.0, 11.0, 12.0

🔴Vulnerability Details

4
OSV
Apache Tomcat Improper Input Validation vulnerability↗2023-10-10
▶
CVEList
Apache Tomcat: Trailer header parsing too lenient↗2023-10-10
▶
OSV
CVE-2023-45648: Improper Input Validation vulnerability in Apache Tomcat↗2023-10-10
▶
GHSA
Apache Tomcat Improper Input Validation vulnerability↗2023-10-10
▶

💥Exploits & PoCs

1
Nuclei
Apache Tomcat - HTTP Request Smuggling
▶

📋Vendor Advisories

6
Ubuntu
Tomcat vulnerabilities↗2025-06-09
▶
Ubuntu
Tomcat vulnerabilities↗2024-11-13
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Apache Tomcat) — CVE-2023-45648↗2024-01-15
▶
Red Hat
tomcat: incorrectly parsed http trailer headers can cause request smuggling↗2023-10-10
▶
Debian
CVE-2023-45648: tomcat10 - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 t...↗2023
▶

💬Community

1
HackerOne
Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)↗2024-02-07
▶
CVE-2023-45648 — Improper Input Validation in Apache | cvebase