An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Den

Summary

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

Timeline

1. Aug 2, 2018, 2:00 PM UTCCVE published
2. Dec 12, 2023, 7:28 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Nov 14, 2024, 8:35 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, 7.0.28 to 7.0.86

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.0.M9 · fixed in 9.0.8

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.5.0 · fixed in 8.5.31

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.0.0RC1 · fixed in 8.0.51

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 7.0.28 · fixed in 7.0.87

References 25