VIR Vulnerability Intelligence Relay

CVE-2016-6816

high
Published 2017-03-20 · Modified 2024-03-11
CVSS v3
7.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v2
6.8
VIR risk
7.1

Description

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

Predictions

Exploit likelihood
80%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2016-6816

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-6816.html

vendor Authored 2026-05-27

Vendor advisory: security@apache.org — https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13

vendor Authored 2026-05-27

Vendor advisory: security@apache.org — https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8

vendor Authored 2026-05-27

Vendor advisory: security@apache.org — https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39

vendor Authored 2026-05-27

Vendor advisory: security@apache.org — https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73

vendor Authored 2026-05-27

Vendor advisory: security@apache.org — https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debianbookwormfixed0
debian debianbullseyefixed0
debian debianforkyfixed0
debian debiansidfixed0
debian debiantrixiefixed0

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.apache.tomcat:tomcat-coyote>=9.0.0.M1,<9.0.0.M129.0.0.M12
java Mavenorg.apache.tomcat:tomcat-coyote>=8.5.0,<8.5.88.5.8
java Mavenorg.apache.tomcat:tomcat-coyote>=8.0.0RC1,<8.0.398.0.39
java Mavenorg.apache.tomcat:tomcat-coyote>=7.0.0,<7.0.737.0.73
java Mavenorg.apache.tomcat:tomcat-coyote>=6.0.0,<6.0.486.0.48

Application impact
VendorProductVersionsFixed
apache apachetomcat6.0.0
apache apachetomcat6.0.1
apache apachetomcat6.0.2
apache apachetomcat6.0.3
apache apachetomcat6.0.4
apache apachetomcat6.0.5
apache apachetomcat6.0.6
apache apachetomcat6.0.7
apache apachetomcat6.0.8
apache apachetomcat6.0.9
apache apachetomcat6.0.10
apache apachetomcat6.0.11
apache apachetomcat6.0.12
apache apachetomcat6.0.13
apache apachetomcat6.0.14
apache apachetomcat6.0.15
apache apachetomcat6.0.16
apache apachetomcat6.0.17
apache apachetomcat6.0.18
apache apachetomcat6.0.19
apache apachetomcat6.0.20
apache apachetomcat6.0.21
apache apachetomcat6.0.22
apache apachetomcat6.0.23
apache apachetomcat6.0.24
apache apachetomcat6.0.25
apache apachetomcat6.0.26
apache apachetomcat6.0.27
apache apachetomcat6.0.28
apache apachetomcat6.0.29
apache apachetomcat6.0.30
apache apachetomcat6.0.31
apache apachetomcat6.0.32
apache apachetomcat6.0.33
apache apachetomcat6.0.34
apache apachetomcat6.0.35
apache apachetomcat6.0.36
apache apachetomcat6.0.37
apache apachetomcat6.0.38
apache apachetomcat6.0.39
apache apachetomcat6.0.40
apache apachetomcat6.0.41
apache apachetomcat6.0.42
apache apachetomcat6.0.43
apache apachetomcat6.0.44
apache apachetomcat6.0.45
apache apachetomcat6.0.46
apache apachetomcat6.0.47
apache apachetomcat7.0.0
apache apachetomcat7.0.1
apache apachetomcat7.0.2
apache apachetomcat7.0.3
apache apachetomcat7.0.4
apache apachetomcat7.0.5
apache apachetomcat7.0.6
apache apachetomcat7.0.7
apache apachetomcat7.0.8
apache apachetomcat7.0.9
apache apachetomcat7.0.10
apache apachetomcat7.0.11
apache apachetomcat7.0.12
apache apachetomcat7.0.13
apache apachetomcat7.0.14
apache apachetomcat7.0.15
apache apachetomcat7.0.16
apache apachetomcat7.0.17
apache apachetomcat7.0.18
apache apachetomcat7.0.19
apache apachetomcat7.0.20
apache apachetomcat7.0.21
apache apachetomcat7.0.22
apache apachetomcat7.0.23
apache apachetomcat7.0.24
apache apachetomcat7.0.25
apache apachetomcat7.0.26
apache apachetomcat7.0.27
apache apachetomcat7.0.28
apache apachetomcat7.0.29
apache apachetomcat7.0.30
apache apachetomcat7.0.31
apache apachetomcat7.0.32
apache apachetomcat7.0.33
apache apachetomcat7.0.34
apache apachetomcat7.0.35
apache apachetomcat7.0.36
apache apachetomcat7.0.37
apache apachetomcat7.0.38
apache apachetomcat7.0.39
apache apachetomcat7.0.40
apache apachetomcat7.0.41
apache apachetomcat7.0.42
apache apachetomcat7.0.43
apache apachetomcat7.0.44
apache apachetomcat7.0.45
apache apachetomcat7.0.46
apache apachetomcat7.0.47
apache apachetomcat7.0.48
apache apachetomcat7.0.49
apache apachetomcat7.0.50
apache apachetomcat7.0.51
apache apachetomcat7.0.52
apache apachetomcat7.0.53
apache apachetomcat7.0.54
apache apachetomcat7.0.55
apache apachetomcat7.0.56
apache apachetomcat7.0.57
apache apachetomcat7.0.58
apache apachetomcat7.0.59
apache apachetomcat7.0.60
apache apachetomcat7.0.61
apache apachetomcat7.0.62
apache apachetomcat7.0.63
apache apachetomcat7.0.64
apache apachetomcat7.0.65
apache apachetomcat7.0.66
apache apachetomcat7.0.67
apache apachetomcat7.0.68
apache apachetomcat7.0.69
apache apachetomcat7.0.70
apache apachetomcat7.0.71
apache apachetomcat7.0.72
apache apachetomcat8.0.0
apache apachetomcat8.0.1
apache apachetomcat8.0.2
apache apachetomcat8.0.3
apache apachetomcat8.0.4
apache apachetomcat8.0.5
apache apachetomcat8.0.6
apache apachetomcat8.0.7
apache apachetomcat8.0.8
apache apachetomcat8.0.9
apache apachetomcat8.0.10
apache apachetomcat8.0.11
apache apachetomcat8.0.12
apache apachetomcat8.0.13
apache apachetomcat8.0.14
apache apachetomcat8.0.15
apache apachetomcat8.0.16
apache apachetomcat8.0.17
apache apachetomcat8.0.18
apache apachetomcat8.0.19
apache apachetomcat8.0.20
apache apachetomcat8.0.21
apache apachetomcat8.0.22
apache apachetomcat8.0.23
apache apachetomcat8.0.24
apache apachetomcat8.0.25
apache apachetomcat8.0.26
apache apachetomcat8.0.27
apache apachetomcat8.0.28
apache apachetomcat8.0.29
apache apachetomcat8.0.30
apache apachetomcat8.0.31
apache apachetomcat8.0.32
apache apachetomcat8.0.33
apache apachetomcat8.0.34
apache apachetomcat8.0.35
apache apachetomcat8.0.36
apache apachetomcat8.0.37
apache apachetomcat8.0.38
apache apachetomcat8.5.0
apache apachetomcat8.5.1
apache apachetomcat8.5.2
apache apachetomcat8.5.3
apache apachetomcat8.5.4
apache apachetomcat8.5.5
apache apachetomcat8.5.6
apache apachetomcat9.0.0

References

CWEs

CWE-20

Verify integrity in audit chain (admin only). AS-IS.