Apache Tomcat 9.0.0.M1 < 9.0.81 multiple vulnerabilities

Tenable plugin 182809 bundles four CVEs affecting Apache Tomcat 9.0.0.M1 through 9.0.80, fixed in 9.0.81. The headliner is CVE-2023-44487 (HTTP/2 Rapid Reset), an unauthenticated denial-of-service flaw that was exploited at unprecedented scale — Google saw 398 million requests/second, Cloudflare 201 million rps, Amazon 155 million rps. The remaining three are lower-impact: CVE-2023-45648 (request smuggling via malformed trailer headers, requires a reverse proxy, CVSS 5.3), CVE-2023-42795 (information leakage from incomplete object recycling, CVSS 5.3), and CVE-2023-42794 (temp-file DoS on Windows only, Low).

Tenable's plugin-level severity of MEDIUM / CVSS 5.3 is misleading because it appears to anchor on the request-smuggling CVE rather than the most dangerous bug in the bundle. CVE-2023-44487 carries CVSS 7.5, an EPSS of 0.99999 (99.997th percentile), and was added to CISA KEV on 2023-10-10 with a federal remediation deadline of 2023-10-31. When a vulnerability has confirmed mass exploitation *and* a KEV listing, rating the bundle MEDIUM sends the wrong signal to patch prioritization workflows. The VPR score of 7.3 (High) is closer to reality, but the plugin's headline severity still reads MEDIUM in most dashboards.

Why this verdict

• KEV-listed with mass exploitation: CVE-2023-44487 was added to CISA KEV on 2023-10-10 after confirmed zero-day exploitation at scales exceeding 398M rps. An EPSS of 0.99999 confirms this is not theoretical.
• Unauthenticated remote, zero friction: The HTTP/2 Rapid Reset attack requires no credentials, no special positioning, and no exploit development. Off-the-shelf tools replicate it. Any internet-facing Tomcat with HTTP/2 enabled is in the blast radius.
• Large exposed population: ~378,000 Tomcat instances are internet-facing per Shodan, and HTTP/2 support is a common configuration in Tomcat 9.x deployments.
• Role multiplier: Tomcat is a *typical-role* application server in most deployments (line-of-business apps, API tiers). It is not canonically a high-value-role component (not an IdP, DC, or hypervisor). However, Tomcat frequently hosts authentication endpoints, API gateways, and customer-facing portals where availability loss has direct revenue and SLA impact. The blast radius is service-level (one application), not fleet-level. This keeps the floor at HIGH rather than CRITICAL.
• Plugin CVSS anchored on wrong CVE: Tenable's plugin-level CVSS 5.3 reflects CVE-2023-45648 (request smuggling), not the most dangerous CVE in the bundle. The VPR of 7.3 partially corrects this, but the dashboard severity label remains MEDIUM.

Why not higher?

The impact ceiling of the dominant CVE (CVE-2023-44487) is denial of service only — no code execution, no data exfiltration, no lateral movement. Tomcat is not a canonically high-value-role component (it's not a DC, hypervisor, or IdP), so even successful exploitation doesn't yield fleet-scale compromise. Many production deployments sit behind CDNs or cloud WAFs that absorb HTTP/2 floods upstream, significantly narrowing the reachable population.

Why not lower?

A KEV-listed vulnerability with EPSS 0.99999 and confirmed mass exploitation at record-breaking scale cannot be rated MEDIUM regardless of impact type. Availability loss on customer-facing Tomcat instances has direct business impact, and the attack is unauthenticated-remote with zero friction. The request-smuggling CVE (CVE-2023-45648) adds integrity risk in reverse-proxy topologies, compounding the case against a downgrade.

1. Deploy HTTP/2 flood protection at the edge — Enable HTTP/2 Rapid Reset mitigation on your CDN, cloud WAF, or load balancer (Cloudflare, AWS Shield, Akamai, F5 all shipped signatures in October 2023). This is the single highest-ROI control — it stops CVE-2023-44487 before traffic reaches Tomcat. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Disable HTTP/2 if not required — If your Tomcat connectors don't need HTTP/2, remove the <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" /> element from server.xml. This eliminates the attack surface for CVE-2023-44487 entirely. Deploy within 30 days.
3. Configure connection and stream limits — Set maxConcurrentStreams to a conservative value (e.g., 100) on the HTTP/2 upgrade protocol in server.xml. This limits the amplification factor of rapid reset attacks. Also set maxConnections and maxThreads appropriately for your capacity.
4. Strip or validate trailer headers at the reverse proxy — Configure your reverse proxy (nginx, HAProxy, Apache httpd) to strip HTTP trailer headers before forwarding to Tomcat. This mitigates CVE-2023-45648 request smuggling. Most proxies support this via configuration.
5. Patch to Tomcat 9.0.81+ — The definitive fix. Upgrade to 9.0.81 or later (current latest 9.0.x recommended). This resolves all four CVEs. Target within the noisgate remediation SLA of 180 days for HIGH, but given KEV status, accelerate to weeks not months.

Run this on each Tomcat host as a user with read access to the Tomcat installation directory. Example: bash check_tomcat_182809.sh /opt/tomcat or bash check_tomcat_182809.sh /usr/share/tomcat9. No root required — only needs to read lib/catalina.jar or RELEASE-NOTES.

#!/usr/bin/env bash
# check_tomcat_182809.sh — Checks if Apache Tomcat is vulnerable to
# CVE-2023-44487, CVE-2023-45648, CVE-2023-42795, CVE-2023-42794
# Fixed in: 9.0.81 (9.x branch)
# Usage: bash check_tomcat_182809.sh /path/to/tomcat
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-}"
if [[ -z "$CATALINA_HOME" ]]; then
  echo "Usage: $0 /path/to/tomcat"
  exit 2
fi

# Try to get version from catalina.jar manifest
VERSION=""
JAR="$CATALINA_HOME/lib/catalina.jar"
if [[ -f "$JAR" ]]; then
  VERSION=$(unzip -p "$JAR" META-INF/MANIFEST.MF 2>/dev/null | grep 'Implementation-Version' | head -1 | cut -d' ' -f2 | tr -d '\r')
fi

# Fallback: RELEASE-NOTES
if [[ -z "$VERSION" && -f "$CATALINA_HOME/RELEASE-NOTES" ]]; then
  VERSION=$(grep -oP 'Apache Tomcat Version \K[0-9]+\.[0-9]+\.[0-9]+' "$CATALINA_HOME/RELEASE-NOTES" | head -1)
fi

# Fallback: version.sh
if [[ -z "$VERSION" && -x "$CATALINA_HOME/bin/version.sh" ]]; then
  VERSION=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | grep 'Server number' | grep -oP '[0-9]+\.[0-9]+\.[0-9]+')
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not determine Tomcat version at $CATALINA_HOME"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Only checking 9.x branch (plugin scope)
if [[ "$MAJOR" -ne 9 ]]; then
  echo "UNKNOWN — this check targets Tomcat 9.x, detected $MAJOR.x"
  exit 2
fi

# Vulnerable: 9.0.0 through 9.0.80
# Fixed: 9.0.81+
if [[ "$MINOR" -eq 0 && "$PATCH" -lt 81 ]]; then
  echo "VULNERABLE — Tomcat $VERSION is affected (fixed in 9.0.81)"
  exit 1
else
  echo "PATCHED — Tomcat $VERSION is >= 9.0.81"
  exit 0
fi

Sources

1. Tenable Plugin 182809
2. CISA Advisory — HTTP/2 Rapid Reset (CVE-2023-44487)
3. Apache Tomcat 9 Security Advisories
4. NVD — CVE-2023-44487
5. NVD — CVE-2023-42795
6. NVD — CVE-2023-42794
7. Qualys — HTTP/2 Rapid Reset Analysis
8. Rapid7 — CVE-2023-44487