Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled…
Priority HIGH 67CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 15 fixed, 6 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.
Summary
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.50896 98th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat-catalina (Maven): 7.0.72, 8.5.5Red Hat: 5 advisoriesRed Hat: 15 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 7.0.0 to before 7.0.72 | 7.0.72 | Patch available | GHSA-v646-rx6w-r3qq |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 8.0.0 to before 8.5.5 | 8.5.5 | Patch available | GHSA-v646-rx6w-r3qq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 7.0.0 to before 7.0.72 Fixed in 7.0.72 Patch available GHSA-v646-rx6w-r3qq
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.0.0 to before 8.5.5 Fixed in 8.5.5 Patch available GHSA-v646-rx6w-r3qq
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:* | up to 7.5.5.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:* Versions up to 7.5.5.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:* | 6 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:* | 7 | Vulnerable | Oracle |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 6.0 – 6.0.45; 7.0 – 7.0.70; 8.0 – 8.5.4 | Vulnerable | Apache |
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·Oracle
- cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:* Versions 7 Vulnerable ·Oracle
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 6.0 – 6.0.45; 7.0 – 7.0.70; 8.0 – 8.5.4 Vulnerable ·Apache
Remediation
- Fix · GHSA-v646-rx6w-r3qq org.apache.tomcat:tomcat-catalina (Maven) Fixed in 7.0.72 Advisory →
- Fix · GHSA-v646-rx6w-r3qq org.apache.tomcat:tomcat-catalina (Maven) Fixed in 8.5.5 Advisory →
Red Hat 5 advisories
- RHSA-2016:2045 Released 2016-10-10 · Red Hat rating Importanttomcat6 security and bug fix update
- Red Hat Enterprise Linux Desktop (v. 6) tomcat6-6.0.24-98.el6_8, tomcat6-admin-webapps-6.0.24-98.el6_8, tomcat6-docs-webapp-6.0.24-98.el6_8 +6
- Red Hat Enterprise Linux HPC Node (v. 6) tomcat6-6.0.24-98.el6_8, tomcat6-admin-webapps-6.0.24-98.el6_8, tomcat6-docs-webapp-6.0.24-98.el6_8 +6
- Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-98.el6_8, tomcat6-admin-webapps-6.0.24-98.el6_8, tomcat6-docs-webapp-6.0.24-98.el6_8 +6
- Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-98.el6_8, tomcat6-admin-webapps-6.0.24-98.el6_8, tomcat6-docs-webapp-6.0.24-98.el6_8 +6
- RHSA-2016:2046 Released 2016-10-10 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.54-8.el7_2, tomcat-servlet-3.0-api-7.0.54-8.el7_2
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-docs-webapp-7.0.54-8.el7_2 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.54-8.el7_2, tomcat-servlet-3.0-api-7.0.54-8.el7_2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-docs-webapp-7.0.54-8.el7_2 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-el-2.2-api-7.0.54-8.el7_2 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-docs-webapp-7.0.54-8.el7_2 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-el-2.2-api-7.0.54-8.el7_2 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.54-8.el7_2, tomcat-javadoc-7.0.54-8.el7_2, tomcat-jsvc-7.0.54-8.el7_2
- RHSA-2016:1636 Released 2016-08-18 · Red Hat rating ImportantRed Hat JBoss Web Server 3.0.3 Service Pack 1 security update
- Red Hat JBoss Web Server 3.0 for RHEL 6 httpd24-2.4.6-62.ep7.el6, httpd24-devel-2.4.6-62.ep7.el6, httpd24-manual-2.4.6-62.ep7.el6 +25
Show 2 more Red Hat advisories
- RHSA-2016:1635 Released 2016-08-18 · Red Hat rating ImportantRed Hat JBoss Web Server 3.0.3 Service Pack 1 security update
- Red Hat JBoss Web Server 3.0 for RHEL 7 httpd24-2.4.6-62.ep7.el7, httpd24-devel-2.4.6-62.ep7.el7, httpd24-manual-2.4.6-62.ep7.el7 +25
- RHSA-2016:1624 Released 2016-08-17 · Red Hat rating ImportantRed Hat JBoss Web Server 3.0.3 Service Pack 1 security update
- Red Hat JBoss Web Server 3.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | — |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 3 | Affected | No fix yet |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2016:2046 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2016:2046 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2016:2046 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2016:2046 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2016:2045 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2016:2045 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2016:2045 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2016:2046 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2016:2046 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2016:2045 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2016:2046 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2016:2046 |
| Red Hat JBoss Web Server 3.0 | Fixed | RHSA-2016:1624 |
| Red Hat JBoss Web Server 3.0 for RHEL 6 | Fixed | RHSA-2016:1636 |
| Red Hat JBoss Web Server 3.0 for RHEL 7 | Fixed | RHSA-2016:1635 |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-5388
- 2026-10-03 Alias added: GHSA-v646-rx6w-r3qq
- 2026-10-16 CISA SSVC decision points changed
References
Advisory 16
- RHSA-2016:1635
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759
- VU#797896
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- RHSA-2016:2045
- RHSA-2016:2046
- https://tomcat.apache.org/tomcat-7.0-doc/changelog.html
- openSUSE-SU-2016:2252
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
- RHSA-2016:1624
- https://www.apache.org/security/asf-httpoxy-response.txt
- https://httpoxy.org/
- RHSA-2016:1636
- https://nvd.nist.gov/vuln/detail/CVE-2016-5388
Other 27
- [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [activemq-issues] 20190826 [jira] [Created] (AMQ-7288) Security Vulnerabilities in ActiveMQ dependent libraries.
- [activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar
- [tomcat-users] 20200813 CVE reporting discrepencies
- [tomcat-users] 20200813 Re: CVE reporting discrepencies
- [tomcat-users] 20200814 Re: CVE reporting discrepencies
- https://github.com/apache/tomcat/commit/1b91e91194a095ea922f96d1dccddf6fbc446e54
- https://github.com/apache/tomcat/commit/880250877b0643956435282afb9c111450cfff4c
- https://github.com/apache/tomcat/commit/fb3569fbb9a2f55459aa8e1e22bc35a737e66329
- https://access.redhat.com/errata/RHSA-2016:1624
- https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39@%3Cusers.tomcat.apache.org%3E
- https://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
- https://rhn.redhat.com/errata/RHSA-2016-1624.html
- https://rhn.redhat.com/errata/RHSA-2016-2045.html
- https://rhn.redhat.com/errata/RHSA-2016-2046.html
- https://www.kb.cert.org/vuls/id/797896
- https://access.redhat.com/errata/RHSA-2016:2045
- https://access.redhat.com/errata/RHSA-2016:2046
- https://access.redhat.com/security/cve/CVE-2016-5388
- https://bugzilla.redhat.com/show_bug.cgi?id=1353809
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d@%3Cissues.activemq.apache.org%3E
Sources
- CVE-2016-5388 · CVE Program
- CVE-2016-5388 · NVD
- FIRST EPSS
- GHSA-v646-rx6w-r3qq · GitHub Advisory Database · CC BY 4.0
- CVE-2016-5388 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences