CVE-2023-45648
MediumApache Tomcat Improper Input Validation vulnerability
Published Oct 11, 2023 · Updated Oct 8, 2026 · Also known as BIT-tomcat-2023-45648, DEBIAN-CVE-2023-45648, GHSA-r6j3-px5g-cq3x, UBUNTU-CVE-2023-45648
Key Facts
Routine patching- CVE-2023-45648 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting Tomcat (Apache), Debian Linux, tomcat10 (debian) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 5.9% probability of exploitation in the next 30 days.
- Fixed versions are available, including Tomcat 8.5.94, Tomcat NA, Tomcat 1:9.0.62-27.el8_9.2.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS (30-day exploit likelihood)
5.9%
Higher than 93.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-45648 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.
Older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
Affected Products
372 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | 10.1.0-milestone1, 10.1.0-milestone10, 10.1.0-milestone11, 10.1.0-milestone12, 10.1.0-milestone13, 10.1.0-milestone14, 10.1.0-milestone15, 10.1.0-milestone16 | 8.5.94 |
| Debian LinuxDebian | 10.0, 11.0, 12.0 | n/a |
| tomcat10debian | See advisory | 10.1.6-1+deb12u1 |
| tomcat9debian | See advisory | 9.0.43-2~deb11u7 |
| libtomcat10-embed-javaubuntu | See advisory | 10.1.16-1ubuntu0.1~esm2 |
Patched Releases
Tomcat
8.5.94, NA, 1:9.0.62-27.el8_9.2, 1:9.0.62-37.el9_3.1, 10.1.14, 7.0.76-10.amzn2.0.7, 9.0.36-150100.4.98.1, 9.0.36-3.111.1, 9.0.81, 9.0.82-2.1, 9.0.85-150200.57.1
devspaces/server-rhel8:3.15
3
jws5-tomcat
0:9.0.62-18.redhat_00016.1.el7jws, 0:9.0.62-18.redhat_00016.1.el8jws, 0:9.0.62-18.redhat_00016.1.el9jws
libtomcat10-embed-java
10.1.16-1ubuntu0.1~esm2
libtomcat10-java
10.1.16-1ubuntu0.1~esm2
libtomcat8-embed-java
8.5.39-1ubuntu1~18.04.3+esm5
libtomcat8-java
8.5.39-1ubuntu1~18.04.3+esm5
libtomcat9-embed-java
9.0.16-3ubuntu0.18.04.2+esm7, 9.0.31-1ubuntu0.9+esm2, 9.0.58-1ubuntu0.2+esm3
libtomcat9-java
9.0.16-3ubuntu0.18.04.2+esm7, 9.0.31-1ubuntu0.9+esm2, 9.0.58-1ubuntu0.2+esm3, 9.0.70-2ubuntu0.1+esm2, 9.0.70-2ubuntu1.24.10.2, 9.0.70-2ubuntu1.25.04.2
org.apache.tomcat:tomcat
10.1.14, 11.0.0-M12, 8.5.94, 9.0.81
org.apache.tomcat:tomcat-coyote
10.1.14, 11.0.0-M12, 8.5.94, 9.0.81
org.apache.tomcat.embed:tomcat-embed-core
10.1.10+sp999, 10.1.14, 11.0.0-M12, 8.5.94, 9.0.81
seal.sp1.org.apache.tomcat.embed:tomcat-embed-core
10.1.10+sp999
seal.sp2.org.apache.tomcat.embed:tomcat-embed-core
10.1.10+sp999
seal.sp3.org.apache.tomcat.embed:tomcat-embed-core
10.1.5+sp999
tomcat-admin-webapps
1:9.0.62-27.el8_9.2, 1:9.0.62-37.el9_3.1, 7.0.76-10.amzn2.0.7, 9.0.36-150100.4.98.1, 9.0.36-3.111.1, 9.0.82-2.1, 9.0.85-150200.57.1
tomcat-docs-webapp
1:9.0.62-27.el8_9.2, 1:9.0.62-37.el9_3.1, 7.0.76-10.amzn2.0.7, 9.0.36-3.111.1, 9.0.82-2.1, 9.0.85-150200.57.1
tomcat-el-2.2-api
7.0.76-10.amzn2.0.7
tomcat-el-3_0-api
9.0.36-150100.4.98.1, 9.0.36-3.111.1, 9.0.82-2.1, 9.0.85-150200.57.1
tomcat-el-3.0-api
1:9.0.62-27.el8_9.2, 1:9.0.62-37.el9_3.1
tomcat-embed
9.0.82-2.1, 9.0.85-150200.57.1
tomcat-javadoc
7.0.76-10.amzn2.0.7, 9.0.36-3.111.1, 9.0.82-2.1, 9.0.85-150200.57.1
tomcat-jsp-2_3-api
9.0.36-150100.4.98.1, 9.0.36-3.111.1, 9.0.82-2.1, 9.0.85-150200.57.1
tomcat-jsp-2.2-api
7.0.76-10.amzn2.0.7
tomcat-jsp-2.3-api
1:9.0.62-27.el8_9.2, 1:9.0.62-37.el9_3.1
Timeline
Publicly disclosed
Oct 11, 2023
Last updated
Oct 8, 2026
Weakness Type
- CWE-20 Improper Input Validation
References
- advisoryRHSA-2023:6206
- advisoryRHSA-2023:6207
- advisoryRHSA-2023:7247
- advisoryRHSA-2024:0125
- advisoryRHSA-2024:0474
FAQ
Common Questions.
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers.
Affected: Tomcat (Apache) versions 10.1.0-milestone1, 10.1.0-milestone10, 10.1.0-milestone11, 10.1.0-milestone12, 10.1.0-milestone13, 10.1.0-milestone14, 10.1.0-milestone15, 10.1.0-milestone16; Debian Linux versions 10.0, 11.0, 12.0; tomcat10 (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Tomcat 8.5.94, Tomcat NA, Tomcat 1:9.0.62-27.el8_9.2.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2023-45648 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo