CVE-2008-4308: Apache Tomcat

Low severity, CVSS 2.6. EPSS: 4.2% chance of exploitation in the next 30 days.

The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.

Affected products

• Apache Tomcat: version 4.1.32 only; version 4.1.33 only; version 4.1.34 only; version 5.5.10 only; version 5.5.11 only; version 5.5.12 only; …

Published 2009-02-26. Last modified 2026-06-16.