HIGH
tomcat: Information leak between requests on the same connection
Published Mar 14, 2017
7.5
HIGHCVSS 3.1
EPSS 7.12%
Description
An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.
Affected products
-
- Version 8.5.7 to 8.5.9StatusaffectedConstraints-
- Version 9.0.0.M11 to 9.0.0.M15StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | n/a |
|
Configuration 1
OR
- n/a
- n/a
No data.
Red Hat JBoss Fuse 6
tomcat8
Not affected
Red Hat JBoss Web Server 3
tomcat8
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat JBoss Fuse 6 | tomcat8 | Not affected | n/a |
| Red Hat JBoss Web Server 3 | tomcat8 | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
7.5 HIGH NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact None
Availability Impact None
7.5 HIGH GHSA
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact None
Availability Impact None
1 other source (Red Hat) ▾
4.7 MEDIUM Red Hat
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Impact Low
Integrity Impact None
Availability Impact None
5.0 MEDIUM NVD
AV:N/AC:L/Au:N/C:P/I:N/A:N
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact None
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Oct 15, 2024 · SSVC 2.0.3
7.12% 0.07121
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.07121
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (11 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 7.12% (0.07121) | 94.06th | v5 (v2026.06.15) |
| Jun 15, 2026 | 7.18% (0.07179) | 93.47th | v5 (v2026.06.15) |
| Mar 30, 2025 | 3.15% (0.03149) | 85.73th | v4 (v2025.03.14) |
| Mar 29, 2025 | 4.22% (0.04216) | 80.92th | v4 (v2025.03.14) |
| Mar 17, 2025 | 3.15% (0.03149) | 86.03th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.19% (0.00189) | 57.65th | v3 (v2023.03.01) |
| Jul 10, 2024 | 0.19% (0.00189) | 56.65th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.19% (0.00189) | 54.60th | v3 (v2023.03.01) |
| Mar 6, 2023 | 3.72% (0.03718) | 85.08th | v2 (v2022.01.01) |
| Apr 1, 2022 | 3.72% (0.03718) | 83.56th | v2 (v2022.01.01) |
| Feb 4, 2022 | 3.72% (0.03718) | 66.71th | v2 (v2022.01.01) |
Weaknesses (1)
References (26)
- http://svn.apache.org/viewvc?view=revision&revision=1774161 x_refsource_CONFIRMIssue TrackingPatchVendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1774166 x_refsource_CONFIRMIssue TrackingPatchVendor Advisory
- http://tomcat.apache.org/security-8.html x_refsource_CONFIRMRelease NotesVendor Advisory
- http://tomcat.apache.org/security-9.html x_refsource_CONFIRMRelease NotesVendor Advisory
- http://www.securityfocus.com/bid/96895 vdb-entryx_refsource_BIDBroken Link
- https://access.redhat.com/security/cve/CVE-2016-8747 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1432006 Issue Tracking
- https://github.com/advisories/GHSA-fjwp-r6fm-q6qw Advisory
- https://github.com/apache/tomcat/commit/452c8094a665ef6375530e81c033da4eeb2e4865
- https://github.com/apache/tomcat/commit/9601a937ff3b7ef5d04b2a0e950d0e44e1bb4cbd
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLISTPatch
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLISTPatch
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLISTPatch
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLISTPatch
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLISTPatch
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLISTPatch
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-8747
- https://security.netapp.com/advisory/ntap-20180614-0002 x_refsource_CONFIRMThird Party Advisory
- https://web.archive.org/web/20200227183332/http://www.securityfocus.com/bid/96895
- https://www.cve.org/CVERecord?id=CVE-2016-8747
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Mar 14, 2017
Updated Oct 15, 2024
Reserved Oct 18, 2016
Link CVE-2016-8747
CISA Vulnrichment
GHSA-FJWP-R6FM-Q6QW Updated Oct 15, 2024