Loading vulnerability…
CVE-2013-4322 is a remotely exploitable denial-of-service vulnerability in Apache Tomcat's HTTP chunked-transfer-coding processing. An incomplete fix for CVE-2012-3544 failed to correctly bound the aggregate amount of streamed chunked data and to safely handle whitespace in trailer-field header values. Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 are affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single Python proof-of-concept script (CVE-2013-4322.py) plus a short README and MIT license. The script implements a network DoS-style PoC for a 'slow POST chunked transmission' weakness: it spawns threads up to MAX_CONCURRENCY (default 300) and, at a fixed interval (INTERVAL_SEC, default 10s), opens a new HTTP(S) connection to HOST (default 127.0.0.1) and sends a POST request with `Transfer-Encoding: chunked` and `Connection: keep-alive`. Each thread then enters an infinite loop sending repeated large chunks (CHUNK_SIZE default 5MB) and never sends the terminating 0-length chunk, keeping requests open indefinitely. This behavior is intended to tie up server resources handling long-lived uploads. Default endpoint is http://127.0.0.1:8081/ (or https://127.0.0.1:443/ if SCHEME is changed).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A network-reachable Apache Tomcat denial-of-service vulnerability caused by incomplete handling of chunked transfer coding, large cumulative chunked-data amounts, or whitespace characters in HTTP header values. It has a CVSS v2 base score of 5.0 and partial availability impact.
A remote denial-of-service vulnerability in Apache Tomcat's handling of HTTP chunked transfer coding and trailer-field header whitespace. Attackers can stream crafted chunked data to exhaust resources or otherwise disrupt service. It resulted from an incomplete fix for CVE-2012-3544.
A previously resolved Apache Tomcat vulnerability referenced only because the advisory corrects a defect in its earlier patch that could trigger an EOFException during chunked-request trailer-header processing.
A previously resolved Apache Tomcat vulnerability mentioned only because its earlier patch caused an EOFException when reading chunked-request trailer headers.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.