Description
It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | tomcat7 | 7.0.56-3+deb8u8 | DSA-3787-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u7 | DSA-3788-1 |
| Debian 7 | tomcat7 | 7.0.28-4+deb7u10 | DLA-823-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.10 | USN-3204-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | tomcat6 | 6.0.39-1ubuntu0.1+esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-6.SP5_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-19.SP17_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.21-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | jboss-as-ee +62 | 7.5.14-2.Final_redhat_2.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.14-2.Final_redhat_2.ep6.el6 | RHSA-2017:0829 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.8-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | jboss-msc | 1.1.7-1.SP1_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.9-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.39-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.21-2.Final_redhat_2.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | picketbox | 4.1.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.17-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.34-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:0828, RHSA-2017:0827, RHSA-2017:0826 |
Advisories 9
- RHSA-2017:0829 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:0828 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.14 update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:0827 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.14 update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:0826 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.14 update on RHEL 5 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-3204-1 tomcat6, tomcat7 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-3787-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-823-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3788-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-1533 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 10, 2025
References
- RHSA-2017:0828 vendor-advisory
- RHSA-2017:0827 vendor-advisory
- https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
- DSA-3787 vendor-advisory
- RHSA-2017:0517 vendor-advisory
- https://lists.debian.org/debian-security-announce/2017/msg00038.html
- https://bugs.debian.org/851304
- DSA-3788 vendor-advisory
- https://security.netapp.com/advisory/ntap-20180731-0002/
- RHSA-2017:0826 vendor-advisory
- RHSA-2017:0829 vendor-advisory
- 96293 vdb-entry
- 1037860 vdb-entry
- https://lists.debian.org/debian-security-announce/2017/msg00039.html
- [activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars. mailing-list
- [activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html