Loading story…
IBM disclosed that the Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server is affected by three Apache Tomcat vulnerabilities: HTTP request smuggling (CVE-2013-4286), remote denial of service (CVE-2013-4322), and arbitrary-file-read information disclosure (CVE-2013-4590). The latter is an XML external entity (XXE) flaw that can expose Tomcat internal information when an attacker can deploy or leverage an untrusted web application containing crafted XML with external entity declarations.
Affected customers should apply IBM's Tomcat 7.0.52 fix packages; IBM listed no workarounds or mitigations. Rational Test Control Panel version 8.5.1 and later is not affected because it no longer uses Apache Tomcat.
See real exploitation activity before you spend the cycle.
13 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2013-4590 was updated.
Fedora pushed tomcat-7.0.52-1.fc20 to the Fedora 20 stable repository to address CVE-2013-4322, the Apache Tomcat chunked-transfer denial-of-service flaw. Red Hat also issued remediation advisories for affected RHEL and JBoss Enterprise Web Server products.
IBM disclosed that Rational Test Workbench and Rational Test Virtualization Server Rational Test Control Panel versions 8.0 through 8.5.0.2 were affected by CVE-2013-4590 and two other Apache Tomcat flaws. IBM directed customers to apply Tomcat 7.0.52 remediation packages; versions 8.5.1 and later were unaffected because they no longer used Tomcat.
Red Hat issued RHSA-2014:0429 to remediate CVE-2013-4322 in the Red Hat Enterprise Linux 6 tomcat6 package. The flaw allowed unauthenticated remote attackers to consume bandwidth, CPU, and memory through excessively long chunked HTTP requests.
CVE-2013-4322 was published for an Apache Tomcat denial-of-service vulnerability in HTTP chunked-transfer coding. The incomplete fix for CVE-2012-3544 allowed remote attackers to exhaust resources with excessive chunked data or whitespace in trailer-field header values.
CVE-2014-0033 was published describing a session-fixation vulnerability in Apache Tomcat 6.0.33 through 6.0.37. The flaw allowed a remote attacker to supply an attacker-controlled session ID through a crafted URL because the disableURLRewriting setting was not honored.
CVE-2013-4590 was published describing an XML external entity vulnerability in Apache Tomcat that could disclose internal information when an attacker could deploy or leverage an untrusted application containing a crafted XML document.
IBM X-Force reported CVE-2013-4286, an Apache Tomcat HTTP request-smuggling flaw caused by incomplete handling of requests containing both Transfer-Encoding: chunked and Content-Length headers. Apache recommended upgrading to Tomcat 6.0.39, 7.0.47, 8.0.0-RC3, or later; exploitation could enable cache poisoning, WAF bypass, and cross-site scripting.
Red Hat issued CVE-2013-4322 updates for Red Hat Enterprise Linux 7 (RHSA-2014:0686) and JBoss Enterprise Web Server 2.0.1 and JBEWS 2 deployments on RHEL 5 and RHEL 6 (RHSA-2014:0525, RHSA-2014:0526, RHSA-2014:0527, and RHSA-2014:0528). The updates addressed the Tomcat chunked-transfer denial-of-service flaw caused by the incomplete CVE-2012-3544 fix.
Red Hat issued updates addressing CVE-2013-4286 for Enterprise Linux 6 and 7 and numerous JBoss products, including Enterprise Application Platform, BRMS, BPM Suite, Data Grid, Data Virtualization, Operations Network, Enterprise Web Server, Fuse Service Works, and Portal. The fixes addressed Tomcat request-framing ambiguity involving Content-Length and chunked-transfer headers or multiple Content-Length headers.
IBM X-Force documented CVE-2013-4322 as an unauthenticated remote denial-of-service vulnerability in Apache Tomcat's processing of HTTP chunked transfer coding, caused by incomplete handling of large aggregate chunked data or whitespace in header values. Apache recommended upgrades to Tomcat 6.0.39, 7.0.50, 8.0.0-RC10, or later.
IBM disclosed that QRadar SIEM 7.1 MR2 and 7.2 MR2 contain Apache Tomcat vulnerabilities CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, and CVE-2013-4590. IBM recommended Patch 7 for QRadar 7.1 MR2 and Patch 3 for QRadar 7.2 MR2, with no workarounds provided.
Red Hat released JBoss Enterprise Application Platform 6.2.2, fixing CVE-2013-4286 in JBoss Web and CVE-2014-0093, which could improperly grant deployed applications java.security.AllPermission. Red Hat advised EAP 6.2 users to install the update and restart JBoss for the changes to take effect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
17 references tracked. Mallory keeps watching after this page renders.
exchange.xforce.ibmcloud.com
Open sourceexchange.xforce.ibmcloud.com
Open sourceexchange.xforce.ibmcloud.com
Open sourcebugzilla.redhat.com
Open sourcesvn.apache.org
Open sourcesvn.apache.org
Open sourcesvn.apache.org
Open sourcesvn.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM disclosed that Apache Tomcat components bundled with Rational Lifecycle Adapter for HP ALM 1.0–1.1 and IBM UrbanCode Release 6.0–6.0.1.4 and 6.1 expose remotely exploitable vulnerabilities without authentication. The issues include denial of service, HTTP request smuggling, session fixation, and information disclosure; deployments of Rational Lifecycle Adapter using WebSphere Application Server are not affected. Of particular concern, **CVE-2014-0096** and **CVE-2014-0119** are XXE-related flaws that permit crafted web applications to read arbitrary files, including files belonging to other applications on the same Tomcat host in the latter case. Organizations should update UrbanCode Release 6.1 to 6.1.0.1 or later and apply `6.0.1.4.ifix01` to the 6.0 line; affected Tomcat installations should be upgraded to fixed releases, including 6.0.40, 7.0.54, and 8.0.6 or later as applicable.
Aug 29, 2026
Apache Tomcat's XML parser handling flaws, **CVE-2014-0119** and **CVE-2013-4590**, could allow a malicious application deployed on a shared Tomcat instance to access sensitive information. CVE-2014-0119 allowed an application to replace XML parsers used by the default servlet, potentially bypassing external-entity limits or reading XML files belonging to other applications; CVE-2013-4590 enabled application-supplied XML files to resolve external entities and potentially bypass Java SecurityManager restrictions. Red Hat released updated `tomcat6` packages for RHEL 6, including `tomcat6-6.0.24-78.el6_5`, and advised administrators to restart Tomcat after applying the update. Affected organizations should use vendor-provided backports or upgrade to fixed upstream releases: Tomcat 6.0.41, 7.0.53, 8.0.5, or later; Tomcat 6 is now end of life and no longer receives security fixes.
Aug 30, 2026
Red Hat released updates for Apache Tomcat and JBoss Web Server deployments on RHEL 6 and RHEL 7 to remediate vulnerabilities spanning local privilege escalation, SecurityManager bypass, directory traversal and disclosure, sensitive-data exposure, and denial of service. On RHEL 6, writable Tomcat configuration files could allow the `tomcat` user—or a compromised web application—to gain root-level code execution through service lifecycle actions; older Tomcat code also allowed authenticated malicious applications to bypass SecurityManager isolation and list parent deployment directories. The updates also address a Commons FileUpload flaw, `CVE-2016-3092`, in which crafted multipart boundaries near the 4,096-byte buffer length could severely slow processing or crash affected Tomcat 7 and 8 applications. Later packages fixed username enumeration through Realm timing differences, SecurityManager bypasses, protected system-property exposure, and unauthorized access to global JNDI resources via `ResourceLinkFactory`; affected organizations should deploy the supported Red Hat Tomcat or JBoss Web Server package updates for their platform.
Aug 29, 2026