CVE-2012-3544

27

FAUCET Score

CVE-2012-3544 describes a denial-of-service vulnerability affecting Apache Tomcat versions 6.x before 6.0.37 and 7.x before 7.0.30, stemming from improper handling of chunk extensions in chunked transfer coding. This vulnerability has a CVSS score of 5.0, indicating a medium severity with a network-based attack vector, low attack complexity, and potential for partial availability impact. While the FAUCET Risk Score is high at 94/100, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		6.0CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:6.0:::::::*
		6.0.0CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:6.0.0:::::::*
		6.0.0CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:6.0.0:alpha::::::
		6.0.1CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:6.0.1:::::::*
		6.0.1CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:6.0.1:alpha::::::

CVSS Data

CVSS version used by this source: 2.0

5.0MEDIUM

AV:N/AC:L/Au:N/C:N/I:N/A:P

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Exploitability Score

10.0

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

11.00%

Probability of exploitation in next 30 days

EPSS Percentile

95.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.1100 is in the 95th percentile among its peer group of 23,684 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (28)

mavenpatch availablevia ghsa

Product: org.apache.tomcat:tomcatFixed in: 6.0.37

mavenpatch availablevia ghsa

Product: org.apache.tomcat:tomcatFixed in: 7.0.30

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: apache-commons-pool-eap6-0:1.6-6.redhat_4.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: dom4j-0:1.6.1-19.redhat_5.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: ecj3-1:3.7.2-6.redhat_1.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: httpd-0:2.2.22-23.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: mod_cluster-0:1.2.4-1.Final_redhat_1.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: mod_cluster-native-0:1.2.4-1.Final.redhat_1.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: mod_jk-0:1.2.37-2.redhat_1.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: tomcat6-0:6.0.37-8_patch_01.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: tomcat7-0:7.0.40-9_patch_01.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: tomcat-native-0:1.1.27-4.redhat_1.ep6.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: apache-commons-pool-eap6-0:1.6-6.redhat_4.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: dom4j-0:1.6.1-19.redhat_5.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: ecj3-1:3.7.2-6.redhat_1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: httpd-0:2.2.22-23.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: mod_cluster-0:1.2.4-1.Final_redhat_1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: mod_cluster-native-0:1.2.4-1.Final.redhat_1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: mod_jk-0:1.2.37-2.redhat_1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: tomcat6-0:6.0.37-10_patch_01.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: tomcat7-0:7.0.40-5_patch_01.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: tomcat-native-0:1.1.27-4.redhat_1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 2.0

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1Fixed in: tomcat6

Vendor Advisories (2)

mavenGHSA-qfxv-3ppc-7qg5medium

Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions

redhatCVE-2012-3544Moderate

tomcat: Limited DoS in chunked transfer encoding input filter

References

archives.neohapsis.com / archives/bugtraq/2013-05/0042.html

seclists.org / fulldisclosure/2014/Dec/23

lists.apache.org / thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E

svn.apache.org / viewvc/tomcat/tc6.0.x/trunk/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java

Patch

svn.apache.org / viewvc

Patch

svn.apache.org / viewvc

Patch

svn.apache.org / viewvc

Patch

tomcat.apache.org / security-6.html

Vendor Advisory

tomcat.apache.org / security-7.html

Vendor Advisory

oracle.com / technetwork/topics/security/cpujan2014-1972949.html

oracle.com / technetwork/topics/security/cpujul2014-1972956.html

securityfocus.com / archive/1/534161/100/0/threaded

securityfocus.com / bid/59797

securityfocus.com / bid/64758

ubuntu.com / usn/USN-1841-1

vmware.com / security/advisories/VMSA-2014-0012.html