CVE-2011-4858: Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form paramet...

Security readout for executives and security teams

Older Apache Tomcat releases can be forced to spend excessive CPU parsing specially crafted form submissions. The practical business impact is service slowdown or outage for applications running vulnerable Tomcat versions. The source bundle does not show code execution, data theft, or confirmed active exploitation. Exposure is most likely on internet-facing or partner-facing Java web applications using Apache Tomcat before the fixed 5.5.35, 6.0.35, or 7.0.23 releases. Legacy Linux distribution packages may also be affected until the relevant vendor advisory update is applied. Schedule remediation for exposed legacy Tomcat systems promptly, especially public applications. This is not evidenced as ransomware-style active exploitation or remote code execution, but it can create real availability incidents with low attacker access requirements. Mitigation focus: Upgrade Tomcat to 5.5.35, 6.0.35, 7.0.23, or a later supported release.; Apply Debian, Red Hat, or other distribution security updates where Tomcat is packaged by the OS vendor.; Prioritize externally reachable Tomcat applications that accept unauthenticated form submissions..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.