CVE-2016-6817

Published on: 08/10/2017 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:11 PM UTC

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Certain versions of Tomcat from Apache contain the following vulnerability:

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

  • CVE-2016-6817 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.
  • Affected Vendor/Software: Apache Software Foundation - Apache Tomcat version 9.0.0.M1 to 9.0.0.M11
  • Affected Vendor/Software: Apache Software Foundation - Apache Tomcat version 8.5.0 to 8.5.6

CVSS3 Score: 7.5 - HIGH

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK LOW NONE NONE
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED NONE NONE HIGH

CVSS2 Score: 5 - MEDIUM

Access
Vector
Access
Complexity
Authentication
NETWORK LOW NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
NONE NONE PARTIAL

CVE References

Description Tags Link
Pony Mail! Vendor Advisory
lists.apache.org
text/html
URL Logo MLIST [announce] 20161122 [SECURITY] CVE-2016-6817 Apache Tomcat Denial of Service
Pony Mail! lists.apache.org
text/html
URL Logo MLIST [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
Pony Mail! lists.apache.org
text/html
URL Logo MLIST [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
Pony Mail! lists.apache.org
text/html
URL Logo MLIST [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
Apache Tomcat CVE-2016-6817 Denial of Service Vulnerability Third Party Advisory
VDB Entry
cve.report (archive)
text/html
URL Logo BID 94462
Apache Tomcat HTTP/2 Header Parsing Error Lets Remote Users Deny Service - SecurityTracker Third Party Advisory
VDB Entry
www.securitytracker.com
text/html
URL Logo SECTRACK 1037330
Pony Mail! lists.apache.org
text/html
URL Logo MLIST [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
November 2016 Apache Tomcat Vulnerabilities in NetApp Products | NetApp Product Security security.netapp.com
text/html
URL Logo CONFIRM security.netapp.com/advisory/ntap-20180607-0001/

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationApacheTomcat8.5.0AllAllAll
ApplicationApacheTomcat8.5.1AllAllAll
ApplicationApacheTomcat8.5.2AllAllAll
ApplicationApacheTomcat8.5.3AllAllAll
ApplicationApacheTomcat8.5.4AllAllAll
ApplicationApacheTomcat8.5.5AllAllAll
ApplicationApacheTomcat8.5.6AllAllAll
ApplicationApacheTomcat9.0.0m1AllAll
ApplicationApacheTomcat9.0.0m10AllAll
ApplicationApacheTomcat9.0.0m11AllAll
ApplicationApacheTomcat9.0.0m2AllAll
ApplicationApacheTomcat9.0.0m3AllAll
ApplicationApacheTomcat9.0.0m4AllAll
ApplicationApacheTomcat9.0.0m5AllAll
ApplicationApacheTomcat9.0.0m6AllAll
ApplicationApacheTomcat9.0.0m7AllAll
ApplicationApacheTomcat9.0.0m8AllAll
ApplicationApacheTomcat9.0.0m9AllAll
ApplicationApacheTomcat8.5.0AllAllAll
ApplicationApacheTomcat8.5.1AllAllAll
ApplicationApacheTomcat8.5.2AllAllAll
ApplicationApacheTomcat8.5.3AllAllAll
ApplicationApacheTomcat8.5.4AllAllAll
ApplicationApacheTomcat8.5.5AllAllAll
ApplicationApacheTomcat8.5.6AllAllAll
ApplicationApacheTomcat9.0.0m1AllAll
ApplicationApacheTomcat9.0.0m10AllAll
ApplicationApacheTomcat9.0.0m11AllAll
ApplicationApacheTomcat9.0.0m2AllAll
ApplicationApacheTomcat9.0.0m3AllAll
ApplicationApacheTomcat9.0.0m4AllAll
ApplicationApacheTomcat9.0.0m5AllAll
ApplicationApacheTomcat9.0.0m6AllAll
ApplicationApacheTomcat9.0.0m7AllAll
ApplicationApacheTomcat9.0.0m8AllAll
ApplicationApacheTomcat9.0.0m9AllAll
  • cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*: