---
id: CVE-2023-46589
aliases:
  - GHSA-fccv-jmmp-qg76
title: Apache Tomcat Improper Input Validation vulnerability
summary: Apache Tomcat Improper Input Validation vulnerability
severity: high
cvss: 7.5
cwe:
  - CWE-20
  - CWE-444
vendor: apache
product: 'org.apache.tomcat:tomcat-catalina'
ecosystem: maven
affected:
  - 'org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.0-M11'
  - 'org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.16'
  - 'org.apache.tomcat:tomcat-catalina >= 9.0.0-M1, < 9.0.83'
  - 'org.apache.tomcat:tomcat-catalina >= 8.5.0, < 8.5.96'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.0-M11'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.16'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M1, < 9.0.83'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, < 8.5.96'
  - 'org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.0-M11'
patched:
  - 'org.apache.tomcat:tomcat-catalina 11.0.0-M11'
  - 'org.apache.tomcat:tomcat-catalina 10.1.16'
  - 'org.apache.tomcat:tomcat-catalina 9.0.83'
  - 'org.apache.tomcat:tomcat-catalina 8.5.96'
  - 'org.apache.tomcat.embed:tomcat-embed-core 11.0.0-M11'
  - 'org.apache.tomcat.embed:tomcat-embed-core 10.1.16'
  - 'org.apache.tomcat.embed:tomcat-embed-core 9.0.83'
  - 'org.apache.tomcat.embed:tomcat-embed-core 8.5.96'
  - 'org.apache.tomcat:tomcat-coyote 11.0.0-M11'
published: '2023-11-28'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T20:14:55Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-fccv-jmmp-qg76'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-46589'
  - url: 'https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr'
  - url: 'http://www.openwall.com/lists/oss-security/2023/11/28/2'
  - url: >-
      https://github.com/apache/tomcat/commit/6f181e1062a472bc5f0234980f66cbde42c1041b
  - url: >-
      https://github.com/apache/tomcat/commit/7a2d8818fcea0b51747a67af9510ce7977245ebd
  - url: >-
      https://github.com/apache/tomcat/commit/aa92971e879a519384c517febc39fd04c48d4642
  - url: >-
      https://github.com/apache/tomcat/commit/b5776d769bffeade865061bc8ecbeb2b56167b08
  - url: 'https://tomcat.apache.org/security-10.html'
  - url: 'https://tomcat.apache.org/security-11.html'
  - url: 'https://tomcat.apache.org/security-8.html'
  - url: 'https://tomcat.apache.org/security-9.html'
  - url: 'https://www.openwall.com/lists/oss-security/2023/11/28/2'
  - url: 'https://lists.debian.org/debian-lts-announce/2024/01/msg00001.html'
  - url: 'https://security.netapp.com/advisory/ntap-20231214-0009'
  - url: 'https://github.com/advisories/GHSA-fccv-jmmp-qg76'
tags:
  - ghsa
  - maven
epss: 0.02651
epssPercentile: 0.85117
ingestedAt: '2026-10-02T22:33:09.854Z'
---

## Overview

Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82, and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

## Affected packages

- `org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.0-M11`
- `org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.16`
- `org.apache.tomcat:tomcat-catalina >= 9.0.0-M1, < 9.0.83`
- `org.apache.tomcat:tomcat-catalina >= 8.5.0, < 8.5.96`
- `org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.0-M11`
- `org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.16`
- `org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M1, < 9.0.83`
- `org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, < 8.5.96`
- `org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.0-M11`

## Remediation

Upgrade to a patched release:

- `org.apache.tomcat:tomcat-catalina 11.0.0-M11`
- `org.apache.tomcat:tomcat-catalina 10.1.16`
- `org.apache.tomcat:tomcat-catalina 9.0.83`
- `org.apache.tomcat:tomcat-catalina 8.5.96`
- `org.apache.tomcat.embed:tomcat-embed-core 11.0.0-M11`
- `org.apache.tomcat.embed:tomcat-embed-core 10.1.16`
- `org.apache.tomcat.embed:tomcat-embed-core 9.0.83`
- `org.apache.tomcat.embed:tomcat-embed-core 8.5.96`
- `org.apache.tomcat:tomcat-coyote 11.0.0-M11`