Apache Tomcat CVE-2011-1475 Input Validation Bypass Vulnerability

Description

Changes introduced to the HTTP BIO connector to support Servlet 3.0 asynchronous requests did not fully account for HTTP pipelining. As a result, when using HTTP pipelining a range of unexpected behaviours occurred including the mixing up of responses between requests. While the mix-up in responses was only observed between requests from the same user, a mix-up of responses for requests from different users may also be possible.

Affected Applications

Apache Tomcat

CVE References

Other References