CVE-2007-1358: Apache Tomcat

Low severity, CVSS 2.6. EPSS: 19.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

Affected products

• Apache Tomcat: up to and including 4.1.31; version 4.0.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; …

Published 2007-05-10. Last modified 2026-06-16.