CVE-2016-6816

CVE-2016-6816: vulnerability in Apache Tomcat

Published 20 Mar 2017 · Updated 14 Nov 2024

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 40%

from disclosure to weapon15 days

Published on NVDMar 20

1st PoC+15d

exploitation probability

40%top 1% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

Affected products

Apache Software Foundation · Apache Tomcat

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/41783unverified cve_referencewww.exploit-db.com/exploits/41783/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Apache Tomcat

In the same product, most dangerous first.

CVE-2017-12617HIGHCVE-2017-12617EPSS 100.0%KEV CVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEV CVE-2017-12615HIGHCVE-2017-12615EPSS 99.6%KEV CVE-2016-8735CRITICALCVE-2016-8735EPSS 90.3%KEV CVE-2026-34486HIGHApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorEPSS 6.6%KEV CVE-2018-11784—CVE-2018-11784EPSS 97.7%

References