CVE-2007-0774: Apache Tomcat JK Connector mod_jk URI Worker Map Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 2.0 score of 7.5 and very high EPSS probability indicate a serious remote code execution risk, though no KEV listing or known ransomware use is documented.

What it is

A stack-based buffer overflow exists in the map_uri_to_worker function of mod_jk.so in Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as shipped with Tomcat 4.1.34 and 5.5.20. A remote attacker can trigger the overflow by sending a long URL that is processed by the URI worker map routine, potentially leading to arbitrary code execution on the web server.

Impact

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code with the privileges of the web server process. This can lead to full compromise of the affected host or service.

Attack surface

The flaw is reachable over the network via HTTP requests to a web server using the vulnerable mod_jk connector. No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/Au:N.

Exploitation

The vulnerability is not listed in CISA KEV and no ransomware groups are documented using it, but EPSS is very high (0.81513, 99.6th percentile), indicating a strong likelihood of exploitation activity. A vendor advisory and patch reference are available.

What to do

• Upgrade mod_jk to a version later than 1.2.20 or apply the vendor patch referenced in the Apache Tomcat changelog.
• If immediate patching is not possible, restrict or filter HTTP requests with excessively long URI paths before they reach the mod_jk connector.
• Deploy a web application firewall or reverse proxy rule to block malformed or oversized URLs targeting the JK connector.
• Review and minimize exposure of the JK connector to untrusted networks where feasible.

Detection

• Monitor web server and mod_jk logs for unusually long URL requests or URI patterns that could trigger the worker map routine.
• Use network intrusion detection signatures for known exploit attempts against CVE-2007-0774.
• Watch for unexpected process crashes or restarts of the web server that may indicate exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.