CVE-2023-45648 Apache Tomcat: Trailer header parsing too lenient

Medium 5.3 Published 10 Oct 2023 Updated 29 Oct 2025

Attackers can exploit improper trailer header parsing to perform request smuggling, bypassing security controls in Apache Tomcat deployments.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-45648?

CVE-2023-45648 is a medium-severity vulnerability in Apache Tomcat, published on 10 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

Weakness: CWE-20

Which versions are affected by CVE-2023-45648?

25 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat. It affects 2 products.

Package	Affected	Fixed in
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `10.1.0-M1`	`10.1.14`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `10.1.0-M1`	`10.1.14`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `11.0.0-M1`	`11.0.0-M12`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `11.0.0-M1`	`11.0.0-M12`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `8.5.0`	`8.5.94`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `8.5.0`	`8.5.94`

19 more packages

`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `9.0.0-M1`	`9.0.81`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `9.0.0-M1`	`9.0.81`
`tomcat` Bitnami	From `8.5.0`	`8.5.94, 9.0.81, 10.1.14`
`org.apache.tomcat:tomcat` Maven	From `10.1.0-M1`	`10.1.14`
`org.apache.tomcat:tomcat` Maven	From `10.1.0-M1`	`10.1.14`
`org.apache.tomcat:tomcat` Maven	From `11.0.0-M1`	`11.0.0-M12`
`org.apache.tomcat:tomcat` Maven	From `11.0.0-M1`	`11.0.0-M12`
`org.apache.tomcat:tomcat` Maven	From `8.5.0`	`8.5.94`
`org.apache.tomcat:tomcat` Maven	From `8.5.0`	`8.5.94`
`org.apache.tomcat:tomcat` Maven	From `9.0.0-M1`	`9.0.81`
`org.apache.tomcat:tomcat` Maven	From `9.0.0-M1`	`9.0.81`
`org.apache.tomcat:tomcat-coyote` Maven	From `10.1.0-M1`	`10.1.14`
`org.apache.tomcat:tomcat-coyote` Maven	From `10.1.0-M1`	`10.1.14`
`org.apache.tomcat:tomcat-coyote` Maven	From `11.0.0-M1`	`11.0.0-M12`
`org.apache.tomcat:tomcat-coyote` Maven	From `11.0.0-M1`	`11.0.0-M12`
`org.apache.tomcat:tomcat-coyote` Maven	From `8.5.0`	`8.5.94`
`org.apache.tomcat:tomcat-coyote` Maven	From `8.5.0`	`8.5.94`
`org.apache.tomcat:tomcat-coyote` Maven	From `9.0.0-M1`	`9.0.81`
`org.apache.tomcat:tomcat-coyote` Maven	From `9.0.0-M1`	`9.0.81`

Products include Apache Tomcat, Debian Debian Linux.

How do I fix CVE-2023-45648?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.14, 11.0.0-M12, 8.5.94 or 9.0.81.

Is CVE-2023-45648 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45648 exists.

Public exploit code: 1 Nuclei template.

All Apache Tomcat vulnerabilities

Sources

Also known as BIT-tomcat-2023-45648, CLSA-2025-1738695770, DEBIAN-CVE-2023-45648, GHSA-r6j3-px5g-cq3x, OESA-2023-1788, UBUNTU-CVE-2023-45648.