Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hxj6-mupf-abbc
Vulnerability ID VCID-hxj6-mupf-abbc
Aliases CVE-2011-3375
GHSA-rp8h-vr48-4j8p
Summary Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
epss 0.02015 https://api.first.org/data/v1/epss?cve=CVE-2011-3375
apache_tomcat Important https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3375
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-rp8h-vr48-4j8p
generic_textual MODERATE https://github.com/apache/tomcat
generic_textual MODERATE https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2011-3375
generic_textual MODERATE http://tomcat.apache.org/security-6.html
generic_textual MODERATE http://tomcat.apache.org/security-7.html
generic_textual MODERATE http://www.debian.org/security/2012/dsa-2401
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3375.json
https://api.first.org/data/v1/epss?cve=CVE-2011-3375
https://github.com/apache/tomcat
https://github.com/apache/tomcat70/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21
https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21
https://nvd.nist.gov/vuln/detail/CVE-2011-3375
https://svn.apache.org/viewvc?view=rev&rev=1176592
https://svn.apache.org/viewvc?view=rev&rev=1185998
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-7.html
http://www.debian.org/security/2012/dsa-2401
782624 https://bugzilla.redhat.com/show_bug.cgi?id=782624
CVE-2011-3375 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3375
GHSA-rp8h-vr48-4j8p https://github.com/advisories/GHSA-rp8h-vr48-4j8p
GLSA-201206-24 https://security.gentoo.org/glsa/201206-24
RHSA-2012:0681 https://access.redhat.com/errata/RHSA-2012:0681
RHSA-2012:0682 https://access.redhat.com/errata/RHSA-2012:0682
USN-1359-1 https://usn.ubuntu.com/1359-1/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.83665
EPSS Score 0.02015
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:38:15.406078+00:00 Apache Tomcat Importer Import https://tomcat.apache.org/security-7.html 38.0.0