CVE-2012-3544: Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked...

Security readout for executives and security teams

This is a remote denial-of-service flaw in old Apache Tomcat 6 and 7 releases. A remote attacker could stream specially formed chunked data and exhaust or disrupt the service. The supplied sources do not show active exploitation, but internet-facing legacy Tomcat should be treated as operationally risky. Exposure is most likely on systems still running Apache Tomcat 6.x before 6.0.37 or 7.x before 7.0.30. Vendor advisories in the bundle indicate some third-party products and OS packages also bundled affected Tomcat versions. Prioritize remediation for internet-facing or business-critical legacy Tomcat. This is not evidenced as actively exploited in the supplied sources, but remote denial of service can still create customer-facing outages and operational disruption. Mitigation focus: Upgrade Tomcat 6 to 6.0.37 or later, or Tomcat 7 to 7.0.30 or later.; Check Apache Tomcat security pages for version-specific guidance.; Review VMware, Oracle, and Ubuntu advisories if those distributions or products are present..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.