← Back

CVE-2016-6817

nvd nist
Published: Aug 10, 2017Modified: May 13, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

Affected (18)

Products: Apache: Tomcat
1 product
Tomcat
Configuration A
18 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Version 8.5.0
Version 8.5.1
Version 8.5.2
Version 8.5.3
Version 8.5.4
Version 8.5.5
Version 8.5.6
Version 9.0.0 milestone10
Version 9.0.0 milestone11
Version 9.0.0 milestone1
Version 9.0.0 milestone2
Version 9.0.0 milestone3
Version 9.0.0 milestone4
Version 9.0.0 milestone5
Version 9.0.0 milestone6
Version 9.0.0 milestone7
Version 9.0.0 milestone8
Version 9.0.0 milestone9

References (16)

Source: security@apache.org
Third Party AdvisoryVDB Entry
Source: security@apache.org
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.