Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-wcfh-wsfa-3ufv
Vulnerability ID VCID-wcfh-wsfa-3ufv
Aliases CVE-2007-0774
Summary Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
Status Published
Exploitability 2.0
Weighted Severity 0.8
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.88357 https://api.first.org/data/v1/epss?cve=CVE-2007-0774
epss 0.88357 https://api.first.org/data/v1/epss?cve=CVE-2007-0774
epss 0.88357 https://api.first.org/data/v1/epss?cve=CVE-2007-0774
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-0774.json
https://api.first.org/data/v1/epss?cve=CVE-2007-0774
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774
1618272 https://bugzilla.redhat.com/show_bug.cgi?id=1618272
CVE-2007-0774 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/4162.c
CVE-2007-0774;OSVDB-33855 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/16798.rb
CVE-2007-0774;OSVDB-33855 Exploit http://www.zerodayinitiative.com/advisories/ZDI-07-008.html
GLSA-200703-16 https://security.gentoo.org/glsa/200703-16
RHSA-2007:0096 https://access.redhat.com/errata/RHSA-2007:0096
RHSA-2007:0164 https://access.redhat.com/errata/RHSA-2007:0164
Data source Metasploit
Description This is a stack buffer overflow exploit for mod_jk 1.2.20. Should work on any Win32 OS.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date March 2, 2007
Platform Windows
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/windows/http/apache_modjk_overflow.rb
Data source Exploit-DB
Date added July 25, 2010
Description Apache Tomcat mod_jk 1.2.20 - Remote Buffer Overflow (Metasploit)
Ransomware campaign use Known
Source publication date July 25, 2010
Exploit type remote
Platform windows
Source update date Oct. 27, 2016
Source URL http://www.zerodayinitiative.com/advisories/ZDI-07-008.html
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.99514
EPSS Score 0.88357
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:40:00.599280+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0