The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the H

Summary

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

Timeline

1. Mar 20, 2017, 6:00 PM UTCCVE published
2. Apr 4, 2017Public exploit on Exploit-DB

   EDB-41783

3. Dec 12, 2023, 9:25 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

4. Nov 14, 2024, 8:05 PM UTCRecord last updated
5. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, 6.0.0 to 6.0.47

• org.apache.tomcat:tomcat-coyoteMaven

  From 9.0.0.M1 · fixed in 9.0.0.M12

• org.apache.tomcat:tomcat-coyoteMaven

  From 8.5.0 · fixed in 8.5.8

• org.apache.tomcat:tomcat-coyoteMaven

  From 8.0.0RC1 · fixed in 8.0.39

• org.apache.tomcat:tomcat-coyoteMaven

  From 7.0.0 · fixed in 7.0.73

• org.apache.tomcat:tomcat-coyoteMaven

  From 6.0.0 · fixed in 6.0.48

References 26