Loading story…
IBM disclosed that Apache Tomcat components bundled with Rational Lifecycle Adapter for HP ALM 1.0–1.1 and IBM UrbanCode Release 6.0–6.0.1.4 and 6.1 expose remotely exploitable vulnerabilities without authentication. The issues include denial of service, HTTP request smuggling, session fixation, and information disclosure; deployments of Rational Lifecycle Adapter using WebSphere Application Server are not affected.
Of particular concern, CVE-2014-0096 and CVE-2014-0119 are XXE-related flaws that permit crafted web applications to read arbitrary files, including files belonging to other applications on the same Tomcat host in the latter case. Organizations should update UrbanCode Release 6.1 to 6.1.0.1 or later and apply 6.0.1.4.ifix01 to the 6.0 line; affected Tomcat installations should be upgraded to fixed releases, including 6.0.40, 7.0.54, and 8.0.6 or later as applicable.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
IBM published a bulletin stating that UrbanCode Release versions 6.0 through 6.0.1.4 and 6.1 contained vulnerable Apache Tomcat components, including CVE-2014-0096 and CVE-2014-0119. IBM advised upgrading the 6.1 line to 6.1.0.1 or later and installing 6.0.1.4.ifix01 for the 6.0 line.
CVE-2014-0119 was published as an XXE information-disclosure vulnerability involving the class loader's XML parser access for XSLT stylesheets. A crafted web application could read arbitrary files, including files associated with other applications on the same Tomcat instance; fixes were included in 6.0.40, 7.0.54, and 8.0.6.
CVE-2014-0096 was published as an XXE-related information-disclosure flaw in Tomcat's default servlet. Crafted web applications could bypass Security Manager restrictions and read arbitrary files; Tomcat 6.0.40, 7.0.53, and 8.0.4 addressed the affected version lines.
Red Hat released a Moderate-impact Apache Tomcat 7 update for Red Hat JBoss Web Server 2.0.1, addressing CVE-2014-0075, CVE-2014-0099, and CVE-2014-0096. Users were advised to install the update and restart the JBoss Web Server process.
Apache Tomcat's requestedSessionSSL field was not reset when a Request object was recycled, potentially allowing control of a subsequent session ID and contributing to session fixation under uncommon SSL-session-ID application configurations. Apache committed fixes for Tomcat 7 and 8, and Red Hat issued updates for affected JBoss Web Server, JBoss Enterprise Web Server, and Red Hat Enterprise Linux products.
Apache Tomcat was found vulnerable to XXE attacks when resolving external entities in application-supplied XML files, allowing a malicious deployed web application to expose Tomcat internals and bypass Java Security Manager restrictions. Upstream fixed the issue in Tomcat 6.0.39, 7.0.50, and 8.0.0-RC10; Red Hat issued fixes for several products but declined to fix Tomcat 5 in RHEL 5 due to compatibility risks during reduced support.
IBM reported that Rational Lifecycle Adapter for HP ALM versions 1.0 through 1.1 were affected by multiple Apache Tomcat vulnerabilities, including CVE-2014-0096 and CVE-2014-0119. Deployments using WebSphere Application Server were stated to be unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcerhn.redhat.com
Open sourcecve.mitre.org
Open sourcebugzilla.redhat.com
Open sourcewww-01.ibm.com
Open sourcebugzilla.redhat.com
Open sourcewww-01.ibm.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM disclosed that the Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server is affected by three Apache Tomcat vulnerabilities: HTTP request smuggling (`CVE-2013-4286`), remote denial of service (`CVE-2013-4322`), and arbitrary-file-read information disclosure (`CVE-2013-4590`). The latter is an XML external entity (XXE) flaw that can expose Tomcat internal information when an attacker can deploy or leverage an untrusted web application containing crafted XML with external entity declarations. Affected customers should apply IBM's Tomcat 7.0.52 fix packages; IBM listed no workarounds or mitigations. Rational Test Control Panel version 8.5.1 and later is not affected because it no longer uses Apache Tomcat.
Aug 31, 2026
Apache Tomcat's XML parser handling flaws, **CVE-2014-0119** and **CVE-2013-4590**, could allow a malicious application deployed on a shared Tomcat instance to access sensitive information. CVE-2014-0119 allowed an application to replace XML parsers used by the default servlet, potentially bypassing external-entity limits or reading XML files belonging to other applications; CVE-2013-4590 enabled application-supplied XML files to resolve external entities and potentially bypass Java SecurityManager restrictions. Red Hat released updated `tomcat6` packages for RHEL 6, including `tomcat6-6.0.24-78.el6_5`, and advised administrators to restart Tomcat after applying the update. Affected organizations should use vendor-provided backports or upgrade to fixed upstream releases: Tomcat 6.0.41, 7.0.53, 8.0.5, or later; Tomcat 6 is now end of life and no longer receives security fixes.
Aug 30, 2026
Red Hat released Moderate-impact updates for Apache Tomcat, JBoss Web Server, JBoss EAP 6.2.4, and JBoss Data Grid to remediate **CVE-2014-0075**, **CVE-2014-0099**, and **CVE-2014-0096**. The flaws could permit remote denial of service through unbounded chunked-transfer input, HTTP request smuggling via integer overflow while parsing `Content-Length` headers—particularly where a vulnerable server sits behind a reverse proxy—and XML external entity (XXE) processing in Tomcat DefaultServlet handling of user-supplied XSLTs. JBoss EAP and Data Grid updates additionally addressed XML parser abuse that could bypass XXE restrictions and expose XML files belonging to other applications on the same instance. Affected RHEL 6 and 7 Tomcat deployments, JBoss Web Server 2.0.1 installations, and EAP 6.2.4 environments should install the applicable vendor packages or upgrades and restart Tomcat or the JBoss server process. Red Hat supplied patched builds including `tomcat-7.0.42-6.el7_0` for RHEL 7 and `tomcat6-6.0.24-72.el6_5` for RHEL 6; JBoss Data Grid 6.2.1 users were directed to upgrade to 6.3.0. Administrators should back up JBoss installations, applications, and configurations before applying updates, and prioritize externally reachable services deployed behind reverse proxies.
Aug 29, 2026