{"id":"CVE-2023-46589","aliases":["GHSA-fccv-jmmp-qg76"],"title":"Apache Tomcat Improper Input Validation vulnerability","summary":"Apache Tomcat Improper Input Validation vulnerability","severity":"high","cvss":7.5,"cwe":["CWE-20","CWE-444"],"vendor":"apache","product":"org.apache.tomcat:tomcat-catalina","ecosystem":"maven","affected":["org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.0-M11","org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.16","org.apache.tomcat:tomcat-catalina >= 9.0.0-M1, < 9.0.83","org.apache.tomcat:tomcat-catalina >= 8.5.0, < 8.5.96","org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.0-M11","org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.16","org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M1, < 9.0.83","org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, < 8.5.96","org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.0-M11"],"patched":["org.apache.tomcat:tomcat-catalina 11.0.0-M11","org.apache.tomcat:tomcat-catalina 10.1.16","org.apache.tomcat:tomcat-catalina 9.0.83","org.apache.tomcat:tomcat-catalina 8.5.96","org.apache.tomcat.embed:tomcat-embed-core 11.0.0-M11","org.apache.tomcat.embed:tomcat-embed-core 10.1.16","org.apache.tomcat.embed:tomcat-embed-core 9.0.83","org.apache.tomcat.embed:tomcat-embed-core 8.5.96","org.apache.tomcat:tomcat-coyote 11.0.0-M11"],"published":"2023-11-28","updated":"2026-10-02","sourceUpdated":"2026-10-02T20:14:55Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-fccv-jmmp-qg76","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46589"},{"url":"https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr"},{"url":"http://www.openwall.com/lists/oss-security/2023/11/28/2"},{"url":"https://github.com/apache/tomcat/commit/6f181e1062a472bc5f0234980f66cbde42c1041b"},{"url":"https://github.com/apache/tomcat/commit/7a2d8818fcea0b51747a67af9510ce7977245ebd"},{"url":"https://github.com/apache/tomcat/commit/aa92971e879a519384c517febc39fd04c48d4642"},{"url":"https://github.com/apache/tomcat/commit/b5776d769bffeade865061bc8ecbeb2b56167b08"},{"url":"https://tomcat.apache.org/security-10.html"},{"url":"https://tomcat.apache.org/security-11.html"},{"url":"https://tomcat.apache.org/security-8.html"},{"url":"https://tomcat.apache.org/security-9.html"},{"url":"https://www.openwall.com/lists/oss-security/2023/11/28/2"},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00001.html"},{"url":"https://security.netapp.com/advisory/ntap-20231214-0009"},{"url":"https://github.com/advisories/GHSA-fccv-jmmp-qg76"}],"tags":["ghsa","maven"],"epss":0.02651,"epssPercentile":0.85117,"ingestedAt":"2026-10-02T22:33:09.854Z","slug":"CVE-2023-46589","body":"## Overview\n\nImproper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82, and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\n\n## Affected packages\n\n- `org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.0-M11`\n- `org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.16`\n- `org.apache.tomcat:tomcat-catalina >= 9.0.0-M1, < 9.0.83`\n- `org.apache.tomcat:tomcat-catalina >= 8.5.0, < 8.5.96`\n- `org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.0-M11`\n- `org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.16`\n- `org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M1, < 9.0.83`\n- `org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, < 8.5.96`\n- `org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.0-M11`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.apache.tomcat:tomcat-catalina 11.0.0-M11`\n- `org.apache.tomcat:tomcat-catalina 10.1.16`\n- `org.apache.tomcat:tomcat-catalina 9.0.83`\n- `org.apache.tomcat:tomcat-catalina 8.5.96`\n- `org.apache.tomcat.embed:tomcat-embed-core 11.0.0-M11`\n- `org.apache.tomcat.embed:tomcat-embed-core 10.1.16`\n- `org.apache.tomcat.embed:tomcat-embed-core 9.0.83`\n- `org.apache.tomcat.embed:tomcat-embed-core 8.5.96`\n- `org.apache.tomcat:tomcat-coyote 11.0.0-M11`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}