GHSA-475f-74wp-pqv5 · Severity: medium · Ecosystem: maven — Integer Overflow or Wraparound in Apache Tomcat
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
Conclusion & alert: CVE-2014-0075 is rated Moderate Risk (49.2/100): CVSS Medium severity, with high exploitation likelihood (EPSS 46.75%, 98th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-27 | 52.26% | 46.75% | -5.51% |
| 2 | 2026-03-13 | 59.29% | 52.26% | -7.03% |
| 3 | 2026-03-04 | — | 59.29% | — |
Full EPSS history (52 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
GHSA-475f-74wp-pqv5 · Severity: medium · Ecosystem: maven — Integer Overflow or Wraparound in Apache Tomcat
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
normal | CVE-2014-0075: 1 GLSA(s) (201412-29), 1 atom(s) (www-servers/tomcat); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2014-0075 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2014-0075 |
ubuntu
|
medium | CVE-2014-0075 medium priority: Ubuntu including 3 source packages (tomcat6, tomcat7, tomcat8), 39 status rows across 13 suites (artful, bionic, lucid, precise, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): not-affected 20, DNE 9, released 7, ignored 3. | https://ubuntu.com/security/CVE-2014-0075 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | tomcat | 7.0.0 | cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.0 | cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* |
| apache | tomcat | 7.0.1 | cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.2 | cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.2 | cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* |
| apache | tomcat | 7.0.3 | cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.4 | cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.4 | cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* |
| apache | tomcat | 7.0.5 | cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.6 | cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.7 | cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.8 | cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.9 | cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.10 | cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.11 | cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.12 | cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.13 | cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.14 | cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.15 | cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.16 | cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.17 | cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.18 | cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.19 | cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.20 | cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.21 | cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.22 | cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.23 | cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.24 | cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.25 | cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.26 | cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.27 | cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.28 | cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.29 | cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.30 | cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.31 | cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.32 | cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.33 | cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.34 | cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.35 | cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.36 | cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.37 | cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.38 | cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.39 | cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.40 | cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.41 | cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.42 | cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.43 | cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.44 | cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.45 | cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.46 | cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.47 | cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.48 | cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.49 | cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.50 | cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.52 | cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:* |
| apache | tomcat | 8.0.0 | cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* |
| apache | tomcat | 8.0.0 | cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:* |
| apache | tomcat | 8.0.0 | cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* |
| apache | tomcat | 8.0.0 | cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:* |
| apache | tomcat | 8.0.1 | cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:* |
| apache | tomcat | 8.0.3 | cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:* |
| apache | tomcat | <= 6.0.39 | cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* |
| apache | tomcat | 6 | cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:* |
| apache | tomcat | 6.0 | cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.0 | cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.0 | cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.1 | cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.1 | cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.2 | cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.2 | cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.2 | cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* |
| apache | tomcat | 6.0.3 | cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.4 | cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.4 | cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.5 | cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.6 | cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.6 | cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.7 | cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.7 | cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.7 | cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:* |