Apache Tomcat does not enforce the maxHttpHeaderSize limit

Description

References

• nvd.nist.gov/vuln/detail/CVE-2011-0534 · ADVISORY
• apache/tomcat commit 0084470 · WEB
• exchange.xforce.ibmcloud.com/vulnerabilities/65162 · WEB
• apache/tomcat · PACKAGE
• support.apple.com/kb/HT5002 · WEB
• web.archive.org/web/20110801035315/http://secunia.com/advisories/45022 · WEB
• web.archive.org/web/20120120085637/http://securityreason.com/securityalert/8074 · WEB
• web.archive.org/web/20121024140440/http://secunia.com/advisories/43192 · WEB
• web.archive.org/web/20121212040149/http://www.securitytracker.com/id · WEB
• web.archive.org/web/20131227020011/http://www.securityfocus.com/bid/46164 · WEB
• web.archive.org/web/20151017023138/http://secunia.com/advisories/57126

org.apache.tomcat:tomcat 的其他漏洞

• CVE-2026-68525严重 9.1Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limi…
• CVE-2026-65905严重 9.8Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made…
• CVE-2026-65182严重 9.1Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a lo…
• CVE-2026-43515严重 9.1Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This i…
• CVE-2026-43514低危 3.7Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 th…