Apache Tomcat 6.0.32 was released [1] to fix, among other things, a logic error in JVM that could cause Double conversion to hang JVM when accessing a form-based security constrained page. It is reported that this behaviour can be used for a denial of service using a carefully crafted request. The upstream report indicates that 6.0.0-6.0.31 is affected by this issue. No further information is available. [1] http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.32
Upstream indicates this is not a bug in tomcat, but in JVM (http://tomcat.apache.org/security-6.html#Not_a_vulnerability_in_Tomcat): "A JVM bug could cause Double conversion to hang JVM when accessing to a form based security constrained page or any page that calls javax.servlet.ServletRequest.getLocale() or javax.servlet.ServletRequest.getLocales(). A specially crafted request can be used to trigger a denial of service. " Upstream does have a workaround for this issue: http://svn.apache.org/viewvc?view=revision&revision=1066315 The real issue is in Java, which is already tracked in bug #674336. *** This bug has been marked as a duplicate of bug 674336 ***