CVE-2005-3510 in Tomcat
Summary
by MITRE
Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/29/2025
Apache Tomcat versions 5.5.0 through 5.5.11 contain a critical denial of service vulnerability that enables remote attackers to consume excessive cpu resources through coordinated directory listing attacks. This vulnerability specifically targets the web application server's handling of directory listings when large numbers of files exist within a single directory. The flaw occurs when the server attempts to process and display directory contents containing thousands or tens of thousands of files, causing the cpu utilization to spike dramatically and potentially leading to complete service unavailability. The attack vector involves sending multiple simultaneous requests to list directories with massive file counts, which forces the server to iterate through and process each file entry in the directory listing, resulting in exponential cpu consumption. This vulnerability directly maps to CWE-400, which addresses unchecked resource consumption, and represents a classic example of a resource exhaustion attack that can be executed without authentication or special privileges. The operational impact extends beyond simple service disruption as it can affect the entire server performance, potentially causing cascading failures in applications relying on the affected tomcat instances. Attackers can leverage this vulnerability to perform distributed denial of service attacks or simply exhaust server resources to make the service unavailable to legitimate users. The vulnerability is particularly dangerous in production environments where tomcat servers handle large file repositories or directory structures with numerous files. According to ATT&CK framework, this represents a resource exhaustion technique under the adversary tactics of denial of service and resource consumption. The flaw demonstrates a fundamental lack of input validation and resource management within the directory listing functionality, where the server does not implement appropriate limits or optimizations for handling large directory structures. Organizations should immediately upgrade to patched versions of Apache Tomcat 5.5.12 or later, as this vulnerability has been addressed through improved directory listing algorithms and resource management controls. Additionally, implementing request rate limiting, directory size restrictions, and monitoring for unusual cpu patterns can help detect and mitigate exploitation attempts. Network segmentation and firewall rules that limit access to directory listing endpoints can also provide additional layers of protection against this type of attack. The vulnerability highlights the importance of proper resource management in web application servers and the need for comprehensive testing of directory handling functions under stress conditions to prevent similar issues in other software components.