Loading story…
Apache Tomcat's doRead error handling flaw, tracked as CVE-2008-4308, can cause POST content from one HTTP request to be sent with a different request. The information-disclosure issue affects Tomcat versions 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20; it results from doRead failing to return -1 under a particular error condition.
Apache's Tomcat 4.x vulnerability documentation continues to list this and other historical flaws affecting the obsolete 4.0.x and 4.1.x branches, including disclosure, denial-of-service, traversal, XSS, session-hijacking, and security-manager-bypass issues. Those branches are unsupported and will not receive further security fixes; organizations running affected releases should upgrade to a supported Tomcat version, at minimum Tomcat 7.x or later as advised in the documentation.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
CVE-2008-4308 was published for an Apache Tomcat doRead error-handling flaw that could send POST content from one HTTP request with another request. The issue affected Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcelists.apache.org
Open sourcelists.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat’s security documentation continues to catalogue numerous historical vulnerabilities in the end-of-life 4.0.x and 4.1.x branches, including information disclosure, denial of service, cross-site scripting, session hijacking, directory traversal, access-control bypass, and a Security Manager bypass. The flaws can expose JSP source, `WEB-INF` resources, prior-request data, session identifiers, and arbitrary files, or enable request-thread exhaustion and proxy-context bypasses. Apache will issue no further security fixes for Tomcat 4.x; some listed defects, including `CVE-2005-4836`, were explicitly not fixed in 4.1.x. The project notes that `CVE-2008-2938` stemmed from JVM UTF-8 URL-decoding behavior, with Tomcat 4.1.39 adding a workaround, and advises organizations still operating Tomcat 4.x to migrate to a supported release—currently Tomcat 9.0.x or later—to receive security updates.
Aug 29, 2026
Apache Tomcat disclosed **CVE-2015-5345**, a low-severity information-disclosure flaw that lets unauthenticated users determine whether protected directories or web-application roots exist. Tomcat processed redirects for directory URLs missing a trailing slash before applying security constraints, exposing the presence of resources that should not be discoverable. Apache corrected the request-processing order by moving redirect handling into `DefaultServlet`, ensuring security constraints and enforcement filters are evaluated before redirects occur. Organizations should upgrade to Tomcat 6.0.45, 7.0.67, 8.0.30, 9.0.0.M3, or later.
Aug 29, 2026
Multiple legacy Apache Tomcat releases are affected by vulnerabilities including HTTP request smuggling (`CVE-2005-2090`), insecure default SSL cipher suites (`CVE-2007-1858`), and cross-site scripting in the bundled calendar example (`CVE-2006-7196`). The request-smuggling flaw affects Tomcat 5.0.19 with Coyote/1.1 and Tomcat 4.1.24 with Coyote/1.0 when conflicting `Transfer-Encoding: chunked` and `Content-Length` headers cause request-body data to be forwarded and interpreted as a separate downstream request. Affected SSL configurations in Tomcat 4.1.28–4.1.31, 5.0.0–5.0.30, and 5.5.0–5.5.17 permit anonymous and other insecure cipher suites, potentially exposing sensitive information. Separately, the `cal2.jsp` calendar example allows script injection through its `time` parameter in several Tomcat 4.x, 5.0.x, and 5.5.x releases. Organizations operating these obsolete versions should remove vulnerable example applications, disable weak SSL ciphers, and upgrade to supported Tomcat releases to mitigate cache poisoning, security-control bypass, data exposure, and XSS risks.
Aug 29, 2026