Database Management

Why Database Performance Analyzer is not affected by CVE-2023-46589

This article explains why DPA is not affected by CVE-2023-46589.

First published date

1/23/2024 5:16 PM

Last published date

1/20/2026 10:25 PM

Overview

In January of 2024, the National Institute of Standards and Technology (NIST) updated the security bulletin about CVE-2023-46589.

Versions of Apache Tomcat with this vulnerability do not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests, which could lead to the possibility of request smuggling when behind a reverse proxy.

Product section

Database Performance Analyzer

Cause

CVE-2023-46589

Resolution

Some supported versions of Database Performance Analyzer (DPA) include affected versions of Apache Tomcat. However, this vulnerability does not apply to DPA because DPA does not use trailer headers. The server.xml file shipped with DPA does not include the allowedTrailerHeaders parameter, which is used to specify the list of allowed trailer headers.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.