HTTP Request Smuggling The advisory has been revoked - it doesn't affect any version of package tomcat7 (opens in a new tab)

Threat Intelligence

9.39% (95^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU1804-TOMCAT7-1137736
published22 Aug 2025
disclosed24 Feb 2020

Report a new vulnerability Found a mistake?

Introduced: 24 Feb 2020

CVE-2020-1935 (opens in a new tab) CWE-444 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:18.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat7 package and not the tomcat7 package as distributed by Ubuntu.

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.