CVE-2005-4836: The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allo...

Security readout for executives and security teams

CVE-2005-4836 affects old Apache Tomcat 4.1 releases. If a server uses the HTTP/1.1 connector with allowLinking enabled, a remote attacker may read JSP source files instead of only rendered pages. That can expose application logic, credentials, or other sensitive information stored in JSPs. Exposure is most likely in legacy Tomcat 4.1.x deployments that still serve applications and have allowLinking configured. Modern Tomcat versions are not named in the supplied affected range. Internet-facing systems increase urgency because the reported attack path is remote. Prioritize if any public or business-critical system still runs Tomcat 4.1.x with allowLinking. The vulnerability is old and conditional, but successful exposure could reveal source code and embedded secrets. If no such legacy deployment exists, treat as a hygiene verification item. Mitigation focus: Identify and retire Tomcat 4.1.15 through 4.1.40 deployments.; Disable allowLinking unless Apache guidance says it is required.; Review Apache Tomcat 4 security guidance for fixed-version direction..

Prepared

Jun 29, 2026, 05:42 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.