CVE-2001-0590 Apache Tomcat Allows Source Disclosure

What is CVE-2001-0590?

CVE-2001-0590 is a medium-severity vulnerability in Apache Tomcat, published on 9 Mar 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

Which versions are affected by CVE-2001-0590?

2 open source packages ship an affected version, including org.apache.tomcat:tomcat-servlet-api. It affects 1 product.

Products include Apache Tomcat.

How do I fix CVE-2001-0590?

Upgrade org.apache.tomcat:tomcat-servlet-api to 3.2.2 or later.

Is CVE-2001-0590 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2001-0590 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x445-mmpw-7r4f.