gitlab/maven/org.apache.tomcat/tomcat/CVE-2005-4836
Exposure of Sensitive Information to an Unauthorized Actor
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.