CVE-2012-2733: Apache Tomcat

Medium severity, CVSS 5.0. EPSS: 8.7% chance of exploitation in the next 30 days.

java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.

Affected products

• Apache Tomcat: version 6.0 only; version 6.0.0 only; version 6.0.1 only; version 6.0.2 only; version 6.0.3 only; version 6.0.4 only; …

Published 2012-11-16. Last modified 2026-06-16.