CVE-2002-0935 in Tomcat
Summary
by MITRE
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2025
Apache Tomcat version 4.0.3 and earlier versions contained a critical resource exhaustion vulnerability that enabled remote attackers to perform denial of service attacks through carefully crafted requests containing null characters. This vulnerability specifically affected the server's request processing mechanism where the presence of null characters in incoming requests caused the working threads to become unresponsive and hang indefinitely. The flaw occurred during the parsing and handling of HTTP requests, where the application failed to properly validate or sanitize input containing null bytes, leading to thread starvation and eventual service unavailability.
The technical implementation of this vulnerability stems from inadequate input validation within Tomcat's HTTP request processing pipeline. When the server encountered requests with null characters embedded in the request data, the parsing logic would become stuck in an infinite loop or enter an unrecoverable state, causing the affected threads to consume system resources without completing their processing tasks. This behavior aligns with CWE-400, which categorizes resource exhaustion vulnerabilities as those that allow attackers to consume system resources such as memory, CPU, or thread pools. The vulnerability specifically targeted the thread management system where each hanging thread represented a consumed resource that could not be reused for legitimate requests.
The operational impact of this vulnerability was severe as it allowed attackers to systematically exhaust the server's thread pool through a relatively simple attack vector. By sending a large volume of requests containing null characters, an attacker could rapidly consume all available working threads, effectively bringing the web server to a halt. This type of attack falls under the ATT&CK technique T1499.004 for Network Denial of Service, where adversaries leverage application-level vulnerabilities to exhaust system resources. The vulnerability was particularly dangerous because it required minimal computational resources to execute while causing maximum disruption to service availability, making it an attractive attack vector for malicious actors seeking to disrupt web applications.
The vulnerability affected Apache Tomcat versions prior to 4.1.3 beta, indicating that this was a known issue that was subsequently addressed in the development cycle. The fix implemented by the Tomcat team involved strengthening input validation mechanisms to properly handle null characters in HTTP requests, ensuring that such characters would either be rejected or properly sanitized before processing. Organizations running affected versions were advised to upgrade to the patched version immediately, as the vulnerability could be exploited without authentication and provided significant impact with minimal effort. This case demonstrates the importance of proper input validation in web applications and highlights how seemingly benign input characters can lead to critical system failures. The vulnerability also underscores the need for comprehensive testing of input handling mechanisms, particularly in server-side applications where resource management is critical for service availability and system stability.