Search for vulnerabilities
| Vulnerability ID | VCID-f2zy-gq57-ufat |
| Aliases |
CVE-2010-2227
GHSA-cxg2-49rq-8gcr |
| Summary | Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 8.0 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Data source | Metasploit |
|---|---|
| Description | Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to-but never completing-the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool, eventually denying additional connection attempts from clients. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source publication date | June 17, 2009 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/slowloris.py |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.99103 |
| EPSS Score | 0.80174 |
| Published At | April 1, 2026, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-04-01T12:38:15.920789+00:00 | Apache Tomcat Importer | Import | https://tomcat.apache.org/security-7.html | 38.0.0 |