CVE-2022-42252: Apache Tomcat

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

Affected products

• Apache Tomcat: from 8.5.0, before 8.5.83 (fixed in 8.5.83); from 9.0.0, before 9.0.68 (fixed in 9.0.68); from 10.0.0, before 10.0.27 (fixed in 10.0.27); from 10.1.0, before 10.1.1 (fixed in 10.1.1)

Published 2022-11-01. Last modified 2026-06-17.