{"api_version":"1","generated_at":"2026-07-23T08:44:31+00:00","cve":"CVE-2017-6056","urls":{"html":"https://cve.report/CVE-2017-6056","api":"https://cve.report/api/cve/CVE-2017-6056.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-6056","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-6056"},"summary":{"title":"CVE-2017-6056","description":"It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2017-02-17 07:59:00","updated_at":"2023-11-07 02:49:00"},"problem_types":["CWE-835"],"metrics":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2017-0828.html","name":"RHSA-2017:0828","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://lists.debian.org/debian-security-announce/2017/msg00038.html","name":"https://lists.debian.org/debian-security-announce/2017/msg00038.html","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"[SECURITY] [DSA 3787-1] tomcat7 security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0826.html","name":"RHSA-2017:0826","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E","name":"[activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d@%3Cissues.activemq.apache.org%3E","name":"[activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar","refsource":"MLIST","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2017/dsa-3788","name":"DSA-3788","refsource":"DEBIAN","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-3788-1 tomcat8","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2017/dsa-3787","name":"DSA-3787","refsource":"DEBIAN","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-3787-1 tomcat7","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","name":"[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.netapp.com/advisory/ntap-20180731-0002/","name":"https://security.netapp.com/advisory/ntap-20180731-0002/","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"November 2017 Apache Tomcat Vulnerabilities in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=60578","name":"https://bz.apache.org/bugzilla/show_bug.cgi?id=60578","refsource":"CONFIRM","tags":["Issue Tracking","Third Party Advisory"],"title":"60578 – Server CPU maxed out (100% per core) randomly after a few hours","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E","name":"[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.","refsource":"MLIST","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/96293","name":"96293","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Apache Tomcat 'http11/AbstractInputBuffer.java' Denial of Service Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://bugs.debian.org/851304","name":"https://bugs.debian.org/851304","refsource":"CONFIRM","tags":["Issue Tracking","Third Party Advisory"],"title":"#851304 - tomcat8 use 100% cpu time - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-security-announce/2017/msg00039.html","name":"https://lists.debian.org/debian-security-announce/2017/msg00039.html","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"[SECURITY] [DSA 3788-1] tomcat8 security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0827.html","name":"RHSA-2017:0827","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","name":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","refsource":"MISC","tags":[],"title":"Oracle Critical Patch Update - October 2019","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0829.html","name":"RHSA-2017:0829","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1037860","name":"1037860","refsource":"SECTRACK","tags":["Third Party Advisory","VDB Entry"],"title":"Apache Tomcat HTTPS Request Processing Bug Lets Remote Users Deny Service - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0517.html","name":"RHSA-2017:0517","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6056","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6056","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"6056","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"12.04","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"6056","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"14.04","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"6056","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"12.04","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"6056","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"14.04","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"6056","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"6056","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2017-6056","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"RHSA-2017:0828","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2017-0828.html"},{"name":"RHSA-2017:0827","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2017-0827.html"},{"name":"https://bz.apache.org/bugzilla/show_bug.cgi?id=60578","refsource":"CONFIRM","url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=60578"},{"name":"DSA-3787","refsource":"DEBIAN","url":"http://www.debian.org/security/2017/dsa-3787"},{"name":"RHSA-2017:0517","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2017-0517.html"},{"name":"https://lists.debian.org/debian-security-announce/2017/msg00038.html","refsource":"CONFIRM","url":"https://lists.debian.org/debian-security-announce/2017/msg00038.html"},{"name":"https://bugs.debian.org/851304","refsource":"CONFIRM","url":"https://bugs.debian.org/851304"},{"name":"DSA-3788","refsource":"DEBIAN","url":"http://www.debian.org/security/2017/dsa-3788"},{"name":"https://security.netapp.com/advisory/ntap-20180731-0002/","refsource":"CONFIRM","url":"https://security.netapp.com/advisory/ntap-20180731-0002/"},{"name":"RHSA-2017:0826","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2017-0826.html"},{"name":"RHSA-2017:0829","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2017-0829.html"},{"name":"96293","refsource":"BID","url":"http://www.securityfocus.com/bid/96293"},{"name":"1037860","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1037860"},{"name":"https://lists.debian.org/debian-security-announce/2017/msg00039.html","refsource":"CONFIRM","url":"https://lists.debian.org/debian-security-announce/2017/msg00039.html"},{"refsource":"MLIST","name":"[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.","url":"https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E"},{"refsource":"MLIST","name":"[activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar","url":"https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d@%3Cissues.activemq.apache.org%3E"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","refsource":"MISC","name":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"}]}},"nvd":{"publishedDate":"2017-02-17 07:59:00","lastModifiedDate":"2023-11-07 02:49:00","problem_types":["CWE-835"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"6056","Ordinal":"102683","Title":"CVE-2017-6056","CVE":"CVE-2017-6056","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"6056","Ordinal":"1","NoteData":"It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.","Type":"Description","Title":null},{"CveYear":"2017","CveId":"6056","Ordinal":"2","NoteData":"2017-02-17","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"6056","Ordinal":"3","NoteData":"2019-10-16","Type":"Other","Title":"Modified"}]}}}