CVE-2002-2272: Apache HTTP Server

High severity, CVSS 7.8. EPSS: 9.7% chance of exploitation in the next 30 days.

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

Affected products

• Apache HTTP Server: version 1.3 only; version 1.3.0 only; version 1.3.1 only; version 1.3.2 only; version 1.3.10 only; version 1.3.11 only; …
• Apache Tomcat: version 4.0.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; version 4.0.5 only; …

Published 2002-12-31. Last modified 2026-06-16.