GHSA-xh5x-j8jf-pcpx · 深刻度： medium · エコシステム： maven — Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
総合評価: CVE-2014-0099 は中リスク（50/100）。CVSS 深刻度は中。悪用される可能性が高い（EPSS 37.86%、97 パーセンタイル） 根拠: EPSS 上、短期間での悪用可能性は高い水準です。 推奨対応: 悪用可能性が高いため、影響範囲の確認と修補の優先付けを推奨します。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-03-27 | 39.08% | 37.86% | -1.22% |
| 2 | 2026-02-23 | 58.78% | 39.08% | -19.71% |
| 3 | 2026-02-19 | — | 58.78% | — |
EPSS の全履歴 （全 17 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 4.3 | 2.0 | MEDIUM |
|
8.6 | 2.9 | [email protected] |
GHSA-xh5x-j8jf-pcpx · 深刻度： medium · エコシステム： maven — Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
normal | CVE-2014-0099: 1 GLSA(s) (201412-29), 1 atom(s) (www-servers/tomcat); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2014-0099 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2014-0099 |
suse
|
medium | CVE-2014-0099 severity moderate: SUSE including 19 source package names (libtcnative-1-0-1.3.3-12.2.1, tomcat-7.0.42-6.el7_0, …), 54 product×package rows across 6 product lines (SUSE Liberty Linux 7, SUSE Linux Enterprise Server 11 SP1-TERADATA, … (6 product lines)): Fixed 54. | https://www.suse.com/security/cve/CVE-2014-0099/ |
ubuntu
|
medium | CVE-2014-0099 medium priority: Ubuntu including 3 source packages (tomcat6, tomcat7, tomcat8), 39 status rows across 13 suites (artful, bionic, lucid, precise, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): not-affected 20, DNE 9, released 7, ignored 3. | https://ubuntu.com/security/CVE-2014-0099 |
| ベンダー | 製品 | バージョン | 生の CPE |
|---|---|---|---|
| apache | tomcat | <= 6.0.39 | cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* |
| apache | tomcat | 6 | cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:* |
| apache | tomcat | 6.0 | cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.0 | cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.0 | cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.1 | cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.1 | cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.2 | cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.2 | cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.2 | cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* |
| apache | tomcat | 6.0.3 | cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.4 | cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.4 | cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.5 | cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.6 | cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.6 | cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.7 | cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.7 | cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.7 | cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:* |
| apache | tomcat | 6.0.8 | cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.8 | cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:* |
| apache | tomcat | 6.0.9 | cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.9 | cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:* |
| apache | tomcat | 6.0.10 | cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.11 | cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.12 | cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.13 | cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.14 | cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.15 | cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.16 | cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.17 | cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.18 | cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.19 | cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.20 | cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.24 | cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.26 | cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.27 | cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.28 | cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.29 | cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.30 | cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.31 | cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.32 | cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.33 | cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.35 | cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.36 | cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.37 | cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:* |
| apache | tomcat | 8.0.0 | cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* |
| apache | tomcat | 8.0.0 | cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:* |
| apache | tomcat | 8.0.0 | cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* |
| apache | tomcat | 8.0.0 | cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:* |
| apache | tomcat | 8.0.1 | cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:* |
| apache | tomcat | 8.0.3 | cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.0 | cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.0 | cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* |
| apache | tomcat | 7.0.1 | cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.2 | cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.2 | cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* |
| apache | tomcat | 7.0.3 | cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.4 | cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.4 | cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* |
| apache | tomcat | 7.0.5 | cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.6 | cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.7 | cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.8 | cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.9 | cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.10 | cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.11 | cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.12 | cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.13 | cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.14 | cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.15 | cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.16 | cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.17 | cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.18 | cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.19 | cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.20 | cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.21 | cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.22 | cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.23 | cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* |
| apache | tomcat | 7.0.24 | cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:* |