CVE-2014-0099: Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7...

Security readout for executives and security teams

CVE-2014-0099 affects older Apache Tomcat versions used behind reverse proxies. A malformed Content-Length header can make the proxy and Tomcat disagree about request boundaries, enabling HTTP request smuggling. Business risk is highest for internet-facing applications with legacy Tomcat behind load balancers, gateways, or reverse proxies. Likely exposure is legacy Apache Tomcat deployments behind reverse proxies. The bundle does not identify specific packaged products beyond Tomcat and downstream vendor advisories, so inventory should focus on Tomcat version and proxy topology. Treat this as a legacy perimeter application risk. It is not flagged as known exploited in the supplied data, but request smuggling can bypass normal controls when vulnerable Tomcat is paired with a proxy. Mitigation focus: Upgrade Tomcat to 6.0.40, 7.0.53, 8.0.4, or later as applicable.; Review downstream vendor advisories for packaged Tomcat fixes.; Prioritize internet-facing Tomcat behind reverse proxies or load balancers..

Prepared

Jun 14, 2026, 07:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.