Apache Tomcat HTTP/0.9 Request Handling Vulnerability Allowing Security Constraint Bypass

A vulnerability in Apache Tomcat related to improper input validation of HTTP/0.9 requests has been identified. Tomcat versions 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0.M1 through 9.0.112, as well as older, end-of-life versions, are affected. The issue arises because Tomcat did not restrict HTTP/0.9 requests to the GET method. This lack of restriction can be exploited to bypass security constraints. For instance, if a security constraint allows HEAD requests to a URI but denies GET requests, a user could send a HEAD request using HTTP/0.9 to circumvent the restriction on GET requests.

Impact

Exploitation of this vulnerability allows users to bypass security constraints, potentially leading to unauthorized access to resources or actions that should be restricted.

Remediation

Users are advised to upgrade to Apache Tomcat 11.0.15 or later, 10.1.50 or later, or 9.0.113 or later.