CVE-2005-2090

31

FAUCET Score

CVE-2005-2090 describes an HTTP Request Smuggling vulnerability affecting Apache Tomcat versions 5.0.19 and 4.1.24. By sending an HTTP request containing both "Transfer-Encoding: chunked" and "Content-Length" headers, remote attackers can manipulate Tomcat's handling of the request body, leading to web cache poisoning, web application firewall bypass, and Cross-Site Scripting (XSS) attacks. This vulnerability has a CVSS score of 4.3, indicating a medium severity with network access, medium attack complexity, and potential for partial integrity impact. There is no evidence of active exploitation, publicly available exploit code in common frameworks like Metasploit or Nuclei, or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		4.1.24CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:4.1.24:::::::*
		5.0.19CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:5.0.19:::::::*

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

29.78%

Probability of exploitation in next 30 days

EPSS Percentile

98.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.2978 is in the 98th percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (79)

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: ant-0:1.6.5-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: avalon-logkit-0:1.2-2jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: axis-0:1.2.1-1jpp_3rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-jaf-0:1.0-2jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-mail-0:1.1.1-2jpp_8rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: geronimo-specs-0:1.0-0.M4.1jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: jakarta-commons-modeler-0:2.0-3jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: log4j-0:1.2.12-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: mx4j-1:3.0.1-1jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: pcsc-lite-0:1.3.3-3.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ca-0:7.3.0-20.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-java-tools-0:7.3.0-10.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-kra-0:7.3.0-14.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-manage-0:7.3.0-19.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-native-tools-0:7.3.0-6.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ocsp-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-tks-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: tomcat5-0:5.5.23-0jpp_4rh.16

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xerces-j2-0:2.7.1-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xml-commons-0:1.3.02-2jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Developer Suite V.3Fixed in: jakarta-commons-modeler-0:2.0-3jpp_3rh

redhatpatch availablevia redhat_api

Product: Red Hat Developer Suite V.3Fixed in: tomcat5-0:5.5.23-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: jakarta-commons-modeler-0:1.1-8jpp.1.0.2.el5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: tomcat5-0:5.5.23-0jpp.1.0.3.el5

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.0Fixed in: jakarta-commons-pool-0:1.2-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.0Fixed in: tomcat5-0:5.0.30-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.0Fixed in: tyrex-0:1.0.1-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.0 (RHEL3)Fixed in: jakarta-commons-pool-0:1.2-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.0 (RHEL3)Fixed in: tomcat5-0:5.0.30-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.0 (RHEL3)Fixed in: tyrex-0:1.0.1-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.1Fixed in: jakarta-commons-pool-0:1.2-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.1Fixed in: tomcat5-0:5.0.30-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.1Fixed in: tyrex-0:1.0.1-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.1 (RHEL3)Fixed in: jakarta-commons-pool-0:1.2-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.1 (RHEL3)Fixed in: tomcat5-0:5.0.30-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.1 (RHEL3)Fixed in: tyrex-0:1.0.1-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jakarta-commons-pool-0:1.2-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: tomcat5-0:5.0.30-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: tyrex-0:1.0.1-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: openmotif21-0:2.1.30-11.RHEL4.6

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jakarta-commons-pool-0:1.2-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: tomcat5-0:5.0.30-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: tyrex-0:1.0.1-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jabberd-0:2.0s10-3.37.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: openmotif21-0:2.1.30-9.RHEL3.8

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: perl-Crypt-CBC-0:2.24-1.el3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modperl-0:1.29-16.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jakarta-commons-pool-0:1.2-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: tomcat5-0:5.0.30-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: tyrex-0:1.0.1-2jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: openmotif21-0:2.1.30-11.RHEL4.6

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jbossas-0:4.0.5-2.CP04.el4s1.2

redhatpatch availablevia redhat_api

Product: RHAPS Version 1 for RHEL 3Fixed in: tomcat5-0:5.0.30-0jpp_5rh

redhatpatch availablevia redhat_api

Product: RHAPS Version 2 for RHEL 4Fixed in: jakarta-commons-modeler-0:2.0-3jpp_2rh

redhatpatch availablevia redhat_api

Product: RHAPS Version 2 for RHEL 4Fixed in: tomcat5-0:5.5.23-0jpp_4rh.3

Vendor Advisories (2)

mavenGHSA-f2gq-p6qv-ccw4medium

Tomcat Vulnerable to Web Cache Poisoning

redhatCVE-2005-2090Moderate

tomcat multiple content-length header poisioning

References

community.ca.com / blogs/casecurityresponseblog/archive/2009/01/23.aspx

Broken Link

docs.info.apple.com / article.html

Broken Link

h20000.www2.hp.com / bizsupport/TechSupport/Document.jsp

Broken Link

lists.apple.com / archives/security-announce//2007/Jul/msg00004.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2008-03/msg00001.html

Third Party Advisory

lists.vmware.com / pipermail/security-announce/2008/000003.html

Third Party Advisory

seclists.org / lists/bugtraq/2005/Jun/0025.html

Mailing ListThird Party Advisory

secunia.com / advisories/26235

Permissions RequiredThird Party Advisory

secunia.com / advisories/26660

Permissions RequiredThird Party Advisory

secunia.com / advisories/27037

Permissions RequiredThird Party Advisory

secunia.com / advisories/28365

Permissions RequiredThird Party Advisory

secunia.com / advisories/29242

Permissions RequiredThird Party Advisory

secunia.com / advisories/30899

Permissions RequiredThird Party Advisory

secunia.com / advisories/30908

Permissions RequiredThird Party Advisory

secunia.com / advisories/33668

Permissions RequiredThird Party Advisory

securitytracker.com / id

Third Party AdvisoryVDB Entry

lists.apache.org / thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10499

Third Party Advisory

sunsolve.sun.com / search/document.do

Broken Link

support.avaya.com / elmodocs2/security/ASA-2007-206.htm

Third Party Advisory

support.ca.com / irj/portal/anonymous/phpsupcontent

Broken LinkThird Party Advisory

tomcat.apache.org / security-4.html

Vendor Advisory

tomcat.apache.org / security-5.html

Vendor Advisory

tomcat.apache.org / security-6.html

Vendor Advisory

fujitsu.com / global/support/software/security/products-f/interstage-200703e.html

Third Party Advisory

redhat.com / support/errata/RHSA-2007-0327.html

Third Party Advisory

redhat.com / support/errata/RHSA-2007-0360.html

Third Party Advisory

redhat.com / support/errata/RHSA-2008-0261.html

Third Party Advisory

securiteam.com / securityreviews/5GP0220G0U.html

ExploitThird Party Advisory

securityfocus.com / archive/1/485938/100/0/threaded

Third Party AdvisoryVDB Entry

securityfocus.com / archive/1/500396/100/0/threaded

Third Party AdvisoryVDB Entry

securityfocus.com / archive/1/500412/100/0/threaded

Third Party AdvisoryVDB Entry

securityfocus.com / bid/13873

Third Party AdvisoryVDB Entry

securityfocus.com / bid/25159

Third Party AdvisoryVDB Entry

vupen.com / english/advisories/2007/2732

Permissions Required

vupen.com / english/advisories/2007/3087

Permissions Required

vupen.com / english/advisories/2007/3386

Permissions Required

vupen.com / english/advisories/2008/0065

Permissions Required

vupen.com / english/advisories/2008/1979/references

Permissions Required

vupen.com / english/advisories/2009/0233

Permissions Required

watchfire.com / resources/HTTP-Request-Smuggling.pdf

Third Party Advisory