InformationThe ability to specify custom status messages opens up the potential for additional headers to be injected. If custom header status messages are required make sure it is only in US-ASCII and does not include any user-supplied data.
Allowing user-supplied data into a header creates the potential for cross-site scripting (XSS).
SolutionTo start Tomcat with USE_CUSTOM_STATUS_MSG_IN_HEADER set to false, add -Dorg.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER=false to your startup script.
By default this is set to false.