CVE-2005-4836: Apache Tomcat

High severity, CVSS 7.8. EPSS: 3.5% chance of exploitation in the next 30 days.

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.

Affected products

• Apache Tomcat: version 4.1.15 only; version 4.1.16 only; version 4.1.17 only; version 4.1.18 only; version 4.1.19 only; version 4.1.20 only; …

Published 2005-12-31. Last modified 2026-06-16.