Description
The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 9.0.0.M1, < 9.0.0.M12 | 9.0.0.M12 | GHSA-698c-2x4j-g9gq |
| Maven | org.apache.tomcat:tomcat | >= 8.5.0, < 8.5.8 | 8.5.8 | GHSA-698c-2x4j-g9gq |
Advisories 2
- WID-SEC-2025-0215 Apache Tomcat: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 29, 2025
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
References
- 1037330 vdb-entry
- [announce] 20161122 [SECURITY] CVE-2016-6817 Apache Tomcat Denial of Service mailing-list
- https://security.netapp.com/advisory/ntap-20180607-0001/
- 94462 vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list