CVE-2005-4836 Apache Tomcat allows remote attackers to read JSP source files

What is CVE-2005-4836?

CVE-2005-4836 is a high-severity vulnerability in Apache Tomcat, published on 9 May 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.

Weakness: CWE-200

Which versions are affected by CVE-2005-4836?

2 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 1 product.

Products include Apache Tomcat.

How do I fix CVE-2005-4836?

No fix has been published for CVE-2005-4836 yet. Limit exposure of the affected software until one is available.

Is CVE-2005-4836 being exploited?

There is no known exploitation of CVE-2005-4836 in the wild and no public exploit code.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qrcx-p4rr-g48h.