CVE-2023-46589

Description

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.15, from 9.0.0 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

How to fix CVE-2023-46589

To remediate CVE-2023-46589, upgrade the affected package to a fixed version below.

—upgrade to 8.5.96 or later
—upgrade to 10.1.6-1+deb12u2 or later
—upgrade to 10.1.6-1+deb12u2 or later
—upgrade to 9.0.43-2~deb11u10 or later
—upgrade to 9.0.31-1~deb10u11 or later
—upgrade to 9.0.43-2~deb11u10 or later
—upgrade to 11.0.0-M11 or later
—upgrade to 11.0.0-M11 or later

Is CVE-2023-46589 being exploited?

Low — EPSS is 2.7%, meaning exploitation activity has not been observed at scale.

Affected packages (8)

>= 8.5.0, < 8.5.96, >= 9.0.0, < 9.0.83, >= 10.1.0, < 10.1.16
from 0, < 10.1.6-1+deb12u2
from 0, < 10.1.6-1+deb12u2
from 0, < 9.0.43-2~deb11u10
from 0, < 9.0.31-1~deb10u11
from 0, < 9.0.43-2~deb11u10
>= 11.0.0-M1, < 11.0.0-M11
>= 11.0.0-M1, < 11.0.0-M11

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N