NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕ Maven
Not in CISA KEV

CVE-2014-0075 — tomcat

Fix: apache/tomcat@b697457

CVE-2014-0075 is a CWE-189 vulnerability in org.apache.tomcat:tomcat. EPSS puts its 30-day exploitation probability at 17.6% (97th percentile). A fix is available for org.apache.tomcat:tomcat — see the affected versions and patch details below.

Integer Overflow or Wraparound in Apache Tomcat

Published
Updated
Affected
6 pkgs
Patched
6 / 6
Exploits
None indexed
Exploitation data as of Oct 25, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2014-0075.

EPSS Exploitation Probability

via FIRST.org ↗
17.6%probability of exploitation in next 30 days
Moderate Risk-2.48%
Lower risk than most CVEs97th percentile — riskier than 97% of all scored CVEsHighest risk
8.83%24.4%39.9%55.5%46.7%17.6%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

6 pkgs affected
☕org.apache.tomcat:tomcat☕org.apache.tomcat:tomcat☕org.apache.tomcat:tomcat☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat:tomcat-coyote☕org.apache.tomcat:tomcat-coyote

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

Affected Packages

6 total 6 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.tomcat:tomcatall versions6.0.40org.apache.tomcat:tomcat:6.0.40
☕Mavenorg.apache.tomcat:tomcat≥ 7.0.0&&< 7.0.537.0.53org.apache.tomcat:tomcat:7.0.53
☕Mavenorg.apache.tomcat:tomcat≥ 8.0.0&&< 8.0.48.0.4org.apache.tomcat:tomcat:8.0.4
☕Mavenorg.apache.tomcat:tomcat-coyoteall versions6.0.40org.apache.tomcat:tomcat-coyote:6.0.40
☕Mavenorg.apache.tomcat:tomcat-coyote≥ 7.0.0&&< 7.0.537.0.53org.apache.tomcat:tomcat-coyote:7.0.53
☕Mavenorg.apache.tomcat:tomcat-coyote≥ 8.0.0&&< 8.0.48.0.4org.apache.tomcat:tomcat-coyote:8.0.4

Affected Products

1 product · 107 configurations
Application
tomcatapache
≤ 6.0.39
90 versions
66.06.0.06.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.9

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.tomcat:tomcat, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.apache.tomcat:tomcat to 6.0.40 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2014-0075 is resolved across your whole dependency graph.

  3. Workarounds

    Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical…

ProductFixed inAdvisory
Red Hat Enterprise Linux 6tomcat6-0:6.0.24-72.el6_5RHSA-2014:0865
Red Hat Enterprise Linux 7tomcat-0:7.0.42-6.el7_0RHSA-2014:0827
Red Hat JBoss BPMS 6.0jbosswebRHSA-2015:0234
Red Hat JBoss BRMS 6.0jbosswebRHSA-2015:0235
Red Hat JBoss Data Grid 6.3jbosswebRHSA-2014:0895
Red Hat JBoss Data Virtualization 6.0jbosswebRHSA-2015:0765
Red Hat JBoss Data Virtualization 6.1see advisoryRHSA-2015:0675
Red Hat JBoss Enterprise Application Platform 6.2see advisoryRHSA-2014:0842
Ubuntu
USN-2302-1Ubuntu

Frequently Asked Questions

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
O3 Security · Impact-Aware SCA

Is CVE-2014-0075 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2014-0075: tomcat DoS — Fixed in 6.0.40