CVE-2003-0866

Apache Tomcat 4.0.x-4.0.3 - Denial of Service via Malformed HTTP Requests

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-0866. PoCs published by Oliver Karow.

AI-analyzed exploit summary This Perl script exploits a denial-of-service vulnerability in Apache Tomcat 4 by sending malformed HTTP requests with specific attack patterns. The repeated requests cause the Tomcat server to stop responding to subsequent requests on the affected port until restarted.

Description

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Oliver Karow · perldoslinux

https://www.exploit-db.com/exploits/23245

View Code ZIP pw:eip

This Perl script exploits a denial-of-service vulnerability in Apache Tomcat 4 by sending malformed HTTP requests with specific attack patterns. The repeated requests cause the Tomcat server to stop responding to subsequent requests on the affected port until restarted.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: Apache Tomcat 4

No auth needed

Prerequisites: Network access to the Tomcat server · Tomcat server running on a known IP and port

MITRE ATT&CK

T1499 - Endpoint Denial of Service

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (12)

Core 12

Core References

Various Sources x_refsource_confirm

http://tomcat.apache.org/security-4.html

Patch, Vendor Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/8824

Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1

Patch, Vendor Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2003/dsa-395

Exploit, Patch, Vendor Advisory x_refsource_confirm

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=215506

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/13429

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30908

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30899

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/1979/references

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Scores

EPSS 0.2041

EPSS Percentile 95.7%

Details

Status published

Products (8)

apache/tomcat 4.0.0

apache/tomcat 4.0.1

apache/tomcat 4.0.2

apache/tomcat 4.0.3

apache/tomcat 4.0.4

apache/tomcat 4.0.5

apache/tomcat 4.0.6

org.apache.tomcat/tomcat 4.0 - 4.1.0Maven

Published Nov 17, 2003

Tracked Since Feb 18, 2026