Executive brief
Apache Tomcat is a widely used web server and application container for Java-based software. A vulnerability in its WebDAV component allows unauthenticated remote users to send excessively large requests, which can exhaust server resources. This could lead to a denial-of-service (DoS) condition, making the web server or hosted applications unavailable to legitimate users.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in Apache Tomcat's WebDAV implementation. The server fails to enforce a limit on the request body size for WebDAV LOCK and PROPFIND requests. Because these methods are often accessible to unauthenticated users, a remote attacker can send specially crafted, large XML request bodies to consume excessive memory or CPU, leading to a denial of service. The fix introduces a configurable 'maxRequestBodySize' parameter for the WebDAV servlet, defaulting to 4096 bytes. Patches are available in versions 11.0.22, 10.1.55, and 9.0.118.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 10.0.0-M1 to 10.0.27, 8.5.0 to 8.5.100, 4.0 to 7.0.109
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
References
- https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc
- http://www.openwall.com/lists/oss-security/2026/05/12/12
- https://github.com/apache/tomcat/commit/17dacd9aa48628da2eba37a9ab743c0b6c71685c
- https://github.com/apache/tomcat/commit/a96fffd18487a29c0a30d36f00cb2b2d91f6d42c
- https://github.com/apache/tomcat/commit/b3d1c1c239142e806be0b7329d304b94a58913ed