CVE-2002-0935: Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a deni...

Security readout for executives and security teams

This is an old Apache Tomcat denial-of-service issue. A remote attacker could send many malformed requests containing null characters and cause Tomcat worker threads to hang, exhausting server capacity. The concern is availability, not confirmed data theft or code execution. Exposure is most plausible on legacy systems still running Apache Tomcat 4.0.3 or possibly pre-4.1.3 beta versions, especially if reachable by untrusted users. Most modern, supported Tomcat deployments are unlikely to be affected, but legacy embedded appliances and forgotten internal services should be checked. Low immediate priority if no legacy Tomcat exists. Moderate priority for organizations with old Java web stacks, unsupported appliances, or internet-facing legacy services because exploitation could disrupt availability without needing authentication. Mitigation focus: Inventory Tomcat versions across servers, containers, appliances, and archived deployments.; Prioritize retirement or upgrade of confirmed Tomcat 4.0.3 and suspected pre-4.1.3 beta instances.; Check Apache or vendor guidance for the appropriate supported replacement version..

Prepared

Jun 30, 2026, 11:55 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.