Loading story…
HP released security bulletin HPSBUX03337 (SSRT102066 rev.1) for HP-UX B.11.31 systems running the HP-UX Apache Web Server Suite, Apache Web Server, Tomcat Servlet Engine, or PHP. The 14 addressed CVEs could enable remote denial of service, man-in-the-middle attacks, remote data modification, and local data modification, with CVSS v2 base scores ranging from 4.3 to 7.5.
HP directed customers to upgrade to HP-UX Web Server Suite v4.05 or later, which updates the bundled Apache, Tomcat, and PHP components to remediated versions. One tracked issue, CVE-2013-5704, affects Apache HTTP Server 2.2.22's mod_headers module and allows remote attackers to bypass configured RequestHeader unset rules by supplying headers in chunked-request trailer fields; Apache stated that this behavior was not a security issue in httpd itself, although downstream vendors issued advisories for affected distributions.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2013-5704 was updated, retaining Apache's position that the behavior was not a security issue in httpd itself and documenting downstream vendor references.
Hewlett-Packard issued HPSBUX03337 (SSRT102066 rev.1) for HP-UX 11i v3 web-server components, including Apache-related CVE-2013-5704. HP directed affected customers to upgrade to HP-UX Web Server Suite v4.05 or later, which includes remediated Apache, Tomcat, and PHP versions.
CVE-2014-0230 was published for an Apache Tomcat denial-of-service flaw triggered when a response is sent before the full request body is read. Remote attackers could repeatedly abort uploads to consume server threads; affected versions were Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9.
CVE-2014-0227 was published for an Apache Tomcat ChunkedInputFilter vulnerability in which malformed chunked transfer coding could cause continued data reads after an error. Remote attackers could use the flaw for HTTP request smuggling or denial of service through resource consumption; affected releases included Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9.
CVE-2014-0075 was published for an integer-overflow vulnerability in Apache Tomcat's ChunkedInputFilter parseChunkHeader function. A remote attacker could send a malformed chunk size in streamed HTTP chunked transfer coding to cause denial of service through resource consumption in Tomcat versions before 6.0.40, 7.0.53, and 8.0.4.
CVE-2014-0099 was published for an integer-overflow flaw in Apache Tomcat's Ascii.java component. A remote attacker could use a crafted Content-Length header to conduct HTTP request smuggling when a vulnerable Tomcat server operated behind a reverse proxy.
CVE-2013-5704 was published for an Apache HTTP Server 2.2.22 mod_headers issue in which a remote attacker could bypass configured RequestHeader unset directives by supplying a header in a chunked-request trailer.
CVE-2013-4286 was published for an Apache Tomcat HTTP request-smuggling vulnerability caused by improper handling of inconsistent request headers in HTTP or AJP connectors. Attackers could manipulate request-length determination using multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers; the flaw was an incomplete fix for CVE-2005-2090.
CVE-2013-4322 was published for an Apache Tomcat denial-of-service flaw in HTTP chunked transfer coding. Crafted streamed chunked data could exploit improper handling of large chunked-data volumes or whitespace in trailer-field header values in affected Tomcat versions.
CVE-2012-3544 was published for an Apache Tomcat denial-of-service flaw caused by improper handling of chunk extensions in HTTP chunked transfer coding. Streaming data with chunk extensions could exhaust resources on affected Tomcat 6 versions before 6.0.37 and Tomcat 7 versions before 7.0.30.
CVE-2012-4534 was published for an Apache Tomcat NIO connector denial-of-service flaw affecting Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 when sendfile and HTTPS were both used. A remote attacker could terminate a connection during response reading to trigger an infinite loop in NioEndpoint.java; fixes were included in Tomcat 6.0.36 and 7.0.28.
CVE-2010-2227 was published for an Apache Tomcat vulnerability in handling invalid HTTP Transfer-Encoding headers. A crafted header could interfere with buffer recycling, causing denial of service or potential sensitive-information disclosure in affected Tomcat 5.5, 6.0, and 7.0 beta versions.
Red Hat published security advisory RHSA-2014:0686. The supplied reference does not include the affected products, vulnerabilities, or remediation details.
Fedora 21's stable repository received tomcat-7.0.59-1.fc21, addressing the CVE-2014-0227 ChunkedInputFilter flaw that could enable resource-exhaustion denial of service and potentially request smuggling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
14 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcemarc.info
Open sourcebugzilla.redhat.com
Open sourcerhn.redhat.com
Open sourceh20564.www2.hp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hewlett-Packard released security bulletins **HPSBUX03102** and **HPSBUX03150** for multiple vulnerabilities in the HP-UX Apache Web Server Suite, affecting bundled Apache HTTP Server, Tomcat Servlet Engine, and PHP components. Impacted systems could be vulnerable to remote code execution, denial of service, HTTP request smuggling, access-control bypass, man-in-the-middle attacks, and unauthorized file or data access; the most severe cited issue, PHP `CVE-2014-3515`, carries a CVSS v2 score of 7.5 and permits remote arbitrary code execution. For HP-UX B.11.31, HP advised upgrading Web Server Suite to version 4.02 or later, including Apache 2.2.15.20, Tomcat 6.0.39.02, and PHP 5.4.11.04. For HP-UX B.11.23 systems using Web Server Suite 3.29 or earlier, Tomcat 5.5.36.01 or earlier, or PHP 5.2.17.03 or earlier, HP recommended Web Server Suite 3.30 or later, with Apache 2.2.15.21, Tomcat 5.5.36.02, and PHP 5.2.17.04.
Aug 29, 2026
Red Hat released **RHSA-2016:0062** for JBoss Web Server 2.1.0 to address `CVE-2015-3183`, `CVE-2013-5704`, and `CVE-2012-0876`. In particular, `CVE-2013-5704` lets an unauthenticated remote client add HTTP Trailer headers to chunked requests after other modules have processed headers, potentially bypassing restrictions enforced with `mod_headers`. The update also addresses HTTP request-smuggling risk and an Expat XML parsing flaw that could enable CPU-exhaustion denial of service; affected users were advised to apply the update and restart the service. HP also issued **HPSBUX03512 (SSRT102254)** for HP-UX Web Server Suite running Apache, citing remote denial of service, access-control bypass, unauthorized modification, information disclosure, and SSL/TLS weaknesses including Logjam and Bar Mitzvah. HP identified Web Server Suite 2.2.15.21 Apache on HP-UX 11i v2 as affected and directed administrators to install updated packages, including Apache `B.2.2.15.18` or later and, where applicable, Tomcat `C.6.0.35.01` or later.
Aug 29, 2026
HP released bulletin **HPSBMA02535** (`SSRT100029 rev.1`) to remediate nine vulnerabilities in HP Performance Manager versions 8.10, 8.20, and 8.21 for HP-UX, Linux, Solaris, and Windows. The flaws could enable remote unauthorized access, cross-site scripting, and denial-of-service conditions; **CVE-2009-3548** was rated highest, with a CVSS v2 base score of 7.5 and potential impact to confidentiality, integrity, and availability. HP issued platform-specific updates: `HPPM8CPI_00001` for HP-UX IA, `HPPM8CPP_00001` for HP-UX PA, `HPPM8CPL_00001` for Linux, `HPPM8CPS_00001` for Solaris, and `HPPM8CPW_00001` for Windows. Related Apache Tomcat advisories also addressed **CVE-2009-0580**, a FORM-authentication user-enumeration flaw in Tomcat 4.1.x, 5.5.x, and 6.0.x that lets remote attackers identify valid usernames through malformed URL-encoded password input to `/j_security_check`.
Aug 29, 2026