CVE-2009-0033: Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP conne...

Security readout for executives and security teams

CVE-2009-0033 is a denial-of-service issue in older Apache Tomcat deployments. A remote request with malformed headers could temporarily block connectors and cause an application outage, but only when the Java AJP connector and mod_jk load balancing are used. Exposure is most likely in legacy Java web stacks still running the listed Tomcat versions with AJP enabled behind mod_jk. Internet-facing applications are not automatically vulnerable unless that configuration is present, but business impact can be high if the affected application is critical. Prioritize remediation where affected Tomcat supports customer-facing, revenue, authentication, or operational workflows. The issue is old and configuration-dependent, but affected systems are also likely unsupported, increasing operational risk beyond this single CVE. Mitigation focus: Inventory Tomcat versions and identify affected legacy releases.; Confirm whether Java AJP and mod_jk load balancing are enabled together.; Upgrade or replace affected Tomcat packages using Apache or distribution guidance..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.