tomcat: Infinite loop in HTTP/2 header parser
Published Aug 10, 2017
7.5
HIGHCVSS 3.1
EPSS 7.19%
Description
The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.
Affected products
-
- Version 8.5.0 to 8.5.6StatusaffectedConstraints-
- Version 9.0.0.M1 to 9.0.0.M11StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | n/a |
|
- 8.5.0
- 8.5.1
- 8.5.2
- 8.5.3
- 8.5.4
- 8.5.5
- 8.5.6
- 9.0.0
- 9.0.0
- 9.0.0
- 9.0.0
- 9.0.0
- 9.0.0
- 9.0.0
- 9.0.0
- 9.0.0
- 9.0.0
- 9.0.0
No data.
Red Hat JBoss Enterprise Application Platform 5
tomcat
Not affected
Red Hat JBoss Enterprise Application Platform 6
tomcat
Not affected
Red Hat JBoss Enterprise Application Platform 7
tomcat
Not affected
Red Hat JBoss Enterprise Web Server 2
tomcat
Not affected
Red Hat JBoss Enterprise Web Server 3
tomcat
Not affected
Red Hat JBoss Web Server 3
tomcat8
Not affected
Red Hat Software Collections
rh-java-common-tomcat
Under investigation
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat JBoss Enterprise Application Platform 5 | tomcat | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | tomcat | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 7 | tomcat | Not affected | n/a |
| Red Hat JBoss Enterprise Web Server 2 | tomcat | Not affected | n/a |
| Red Hat JBoss Enterprise Web Server 3 | tomcat | Not affected | n/a |
| Red Hat JBoss Web Server 3 | tomcat8 | Not affected | n/a |
| Red Hat Software Collections | rh-java-common-tomcat | Under investigation | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Oct 15, 2024 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (14 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 7.19% (0.07190) | 94.12th | v5 (v2026.06.15) |
| Jun 15, 2026 | 7.19% (0.07190) | 93.48th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.15% (0.00151) | 33.08th | v4 (v2025.03.14) |
| Jan 20, 2025 | 1.17% (0.01170) | 84.88th | v3 (v2023.03.01) |
| Dec 12, 2024 | 2.22% (0.02222) | 89.90th | v3 (v2023.03.01) |
| May 4, 2024 | 1.80% (0.01797) | 88.04th | v3 (v2023.03.01) |
| Nov 14, 2023 | 2.53% (0.02526) | 89.00th | v3 (v2023.03.01) |
| Nov 8, 2023 | 3.54% (0.03537) | 90.52th | v3 (v2023.03.01) |
| Mar 30, 2023 | 2.94% (0.02941) | 89.29th | v3 (v2023.03.01) |
| Mar 7, 2023 | 3.48% (0.03476) | 90.04th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.86% (0.01859) | 77.22th | v2 (v2022.01.01) |
| Feb 23, 2023 | 1.86% (0.01859) | 77.17th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.86% (0.01859) | 75.15th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.86% (0.01859) | 54.46th | v2 (v2022.01.01) |
References (22)
- http://www.securityfocus.com/bid/94462 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037330 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2016-6817 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1397474 Issue Tracking
- https://github.com/advisories/GHSA-698c-2x4j-g9gq Advisory
- https://github.com/apache/tomcat/commit/079372fc7bac8e2e378942715c9ce26a4a72c07a
- https://github.com/apache/tomcat/commit/85c63227edabbfb4f2f500fc557480a190135d21
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/a9f24571460af003071475b75f18cad81ebcc36fa7c876965a75e32a%40%3Cannounce.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/a9f24571460af003071475b75f18cad81ebcc36fa7c876965a75e32a@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-6817
- https://security.netapp.com/advisory/ntap-20180607-0001 x_refsource_CONFIRM
- https://web.archive.org/web/20180115024458/http://www.securitytracker.com/id/1037330
- https://web.archive.org/web/20200227174145/http://www.securityfocus.com/bid/94462
- https://www.cve.org/CVERecord?id=CVE-2016-6817
Change history (0)
No recorded changes yet.