CVE-2012-2733: java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x be...

Security readout for executives and security teams

This CVE is an availability issue in older Apache Tomcat HTTP NIO handling. A remote attacker could send excessive request-header data and consume server memory, potentially disrupting hosted applications. The provided sources do not show active exploitation or a CVSS score. Exposure is most likely where Tomcat 6.x before 6.0.36 or 7.x before 7.0.28 uses the HTTP NIO connector and receives untrusted HTTP traffic. Distribution-packaged Tomcat may have backported fixes, so version and vendor advisory status both matter. Prioritize remediation for exposed Tomcat services because the issue can disrupt application availability remotely. It is less severe than code execution, but older Tomcat deployments often support business-critical legacy applications and may lack current vendor support. Mitigation focus: Upgrade Tomcat 6 to 6.0.36 or later if still applicable.; Upgrade Tomcat 7 to 7.0.28 or later if still applicable.; Check OS vendor advisories for backported fixed packages..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.