CVE-2018-1336 — In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder

Description

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tomcat	9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, 7.0.28 to 7.0.86	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 9	tomcat8	8.5.14-1+deb9u3	DSA-4281-1
Debian 8	tomcat8	8.0.14-1+deb8u13	DLA-1491-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	tomcat8	8.5.39-1ubuntu1~18.04.1	—
Ubuntu 16.04 LTS	tomcat8	8.0.32-1ubuntu1.7	USN-3723-1
Ubuntu 14.04 LTS	tomcat7	7.0.52-1ubuntu0.15	USN-3723-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	tomcat7	7.0.68-1ubuntu0.4+esm1	USN-4791-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	tomcat +9	7.0.76-8.el7_5	RHSA-2018:2921

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 5	jws5 +1	1-5.el6jws	RHEA-2018:2189, RHEA-2018:2188
Red Hat JBoss Web Server 5	jws5-ecj	4.6.1-5.redhat_1.1.el6jws	RHEA-2018:2189, RHEA-2018:2188
Red Hat JBoss Web Server 5	jws5-javapackages-tools +1	3.4.1-5.15.7.el6jws	RHEA-2018:2189, RHEA-2018:2188
Red Hat JBoss Web Server 5	jws5-jboss-logging	3.3.1-4.Final_redhat_1.1.el6jws	RHEA-2018:2189, RHEA-2018:2188
Red Hat JBoss Web Server 5	jws5-mod_cluster +1	1.4.0-8.Final_redhat_1.1.el6jws	RHEA-2018:2189, RHEA-2018:2188
Red Hat JBoss Web Server 5	jws5-tomcat +10	9.0.7-10.redhat_10.1.el6jws	RHEA-2018:2189, RHEA-2018:2188
Red Hat JBoss Web Server 5	jws5-tomcat-native	1.2.17-20.redhat_20.el6jws	RHEA-2018:2189, RHEA-2018:2188
Red Hat JBoss Web Server 5	jws5-tomcat-vault +1	1.1.7-3.Final_redhat_1.1.el6jws	RHEA-2018:2189, RHEA-2018:2188
Red Hat JBoss Web Server 3	tomcat7 +11	7.0.70-29.ep7.el6	RHSA-2018:2701
Red Hat JBoss Web Server 3	tomcat8 +11	8.0.36-33.ep7.el6	RHSA-2018:2701
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-14.redhat_7.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	guava-libraries	13.0.1-5.redhat_3.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	hibernate4-validator	4.3.4-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	hornetq	2.3.25-27.SP28_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.42-2.Final_redhat_2.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-as-ee +54	7.5.21-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.41-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-modules	1.3.11-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-vfs2	3.2.13-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jboss-xnio-base	3.0.17-1.GA_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jbossas-core +6	7.5.21-2.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jbossas-javadocs	7.5.21-2.Final_redhat_1.2.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	jbossweb	7.5.29-1.Final_redhat_1.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	picketlink-bindings	2.5.4-23.SP18_redhat_2.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	picketlink-federation	2.5.4-21.SP18_redhat_2.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741
Red Hat JBoss EAP 6	xerces-j2-eap6	2.9.1-19.redhat_8.1.ep6.el5	RHSA-2018:2743, RHSA-2018:2742, RHSA-2018:2741

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15	tomcat	9.0.10-3.7.1	SUSE-SU-2018:3011-1
SLES 12 SP3	tomcat	8.0.53-29.13.1	SUSE-SU-2018:2699-1
SLES 12 SP1	tomcat	8.0.53-10.35.1	SUSE-SU-2018:3388-1
SLES 12	tomcat	7.0.90-7.23.1	SUSE-SU-2018:3261-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP3	tomcat	8.0.53-29.13.1	SUSE-SU-2018:2699-1
SLES for SAP 12 SP1	tomcat	8.0.53-10.35.1	SUSE-SU-2018:3388-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	tomcat	9.0.36-8.4	openSUSE-SU-2024:11468-1
openSUSE Tumbleweed	tomcat10	10.1.14-1.1	openSUSE-SU-2024:13441-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	tomcat +9	7.0.76-8.amzn2	ALAS2-2018-1105

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	tomcat +9	7.0.76-8.el7_5	ELSA-2018-2921

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 9.0.0.M9, < 9.0.8	9.0.8	GHSA-m59c-jpc8-m2x4
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.5.0, < 8.5.31	8.5.31	GHSA-m59c-jpc8-m2x4
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.0.0RC1, < 8.0.51	8.0.51	GHSA-m59c-jpc8-m2x4
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 7.0.28, < 7.0.87	7.0.87	GHSA-m59c-jpc8-m2x4

Advisories 21

RHSA-2018:2921 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2742 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.21 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2743 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.21 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2741 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.21 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:2701 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 5 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHEA-2018:2189 Red Hat Enhancement Advisory: Red Hat JBoss Web Server 5.0.0 enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHEA-2018:2188 Red Hat Enhancement Advisory: Red Hat JBoss Web Server 5.0.0 enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
WID-SEC-2026-2610 Apache Tomcat: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 2, 2026
USN-4791-1 tomcat7 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
USN-3723-1 tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-4281-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1491-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2018:3261-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:3388-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:2699-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:3011-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
ALAS2-2018-1105 Important: tomcat security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 8, 2018
ELSA-2018-2921 Important: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 16, 2018

References

USN-3723-1 vendor-advisory
104898 vdb-entry
RHSA-2018:2740 vendor-advisory
RHSA-2018:2741 vendor-advisory
RHSA-2018:2921 vendor-advisory
RHSA-2018:2742 vendor-advisory
DSA-4281 vendor-advisory
RHSA-2018:2945 vendor-advisory
RHSA-2018:2939 vendor-advisory
RHSA-2018:2701 vendor-advisory
https://security.netapp.com/advisory/ntap-20180817-0001/
RHEA-2018:2188 vendor-advisory
[www-announce] 20180722 [SECURITY] CVE-2018-1336 Apache Tomcat - Denial of Service mailing-list
RHEA-2018:2189 vendor-advisory
RHSA-2018:2743 vendor-advisory
RHSA-2018:2700 vendor-advisory
[debian-lts-announce] 20180902 [SECURITY] [DLA 1491-1] tomcat8 security update mailing-list
RHSA-2018:3768 vendor-advisory
RHSA-2018:2930 vendor-advisory
1041375 vdb-entry
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
https://support.f5.com/csp/article/K73008537?utm_source=f5support&amp%3Butm_medium=RSS
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
https://www.oracle.com/security-alerts/cpuapr2020.html