CVE-2022-42252 Apache Tomcat request smuggling via malformed content-length

What is CVE-2022-42252?

CVE-2022-42252 is a high-severity vulnerability in Apache Tomcat, published on 1 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

Weakness: CWE-444

Which versions are affected by CVE-2022-42252?

15 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-coyote. It affects 1 product.

Products include Apache Tomcat.

How do I fix CVE-2022-42252?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.0.27, 10.1.1, 8.5.83 or 9.0.68.

Is CVE-2022-42252 being exploited?

There is no known exploitation of CVE-2022-42252 in the wild and no public exploit code.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-tomcat-2022-42252, CLEANSTART-2026-AT03088, CLSA-2026-1793133072, DEBIAN-CVE-2022-42252, GHSA-p22x-g9px-3945, OESA-2023-1058 and 5 more.