Information disclosure in Apache Tomcat
Priority MEDIUM 49CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07121 94th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 8.5.10, 9.0.0.M16
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 8.5.7 to 8.5.9; 9.0.0.M11 to 9.0.0.M15 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 8.5.7 to before 8.5.10 | 8.5.10 | Patch available | GHSA-fjwp-r6fm-q6qw |
| — | org.apache.tomcat:tomcat (Maven) | 9.0.0.M11 to before 9.0.0.M16 | 9.0.0.M16 | Patch available | GHSA-fjwp-r6fm-q6qw |
- Apache Tomcat VendorApache Affected 8.5.7 to 8.5.9; 9.0.0.M11 to 9.0.0.M15 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.7 to before 8.5.10 Fixed in 8.5.10 Patch available GHSA-fjwp-r6fm-q6qw
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0.M11 to before 9.0.0.M16 Fixed in 9.0.0.M16 Patch available GHSA-fjwp-r6fm-q6qw
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 8.5.7 to before 8.5.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.7 to before 8.5.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
Remediation
- Fix · GHSA-fjwp-r6fm-q6qw org.apache.tomcat:tomcat (Maven) Fixed in 8.5.10 Advisory →
- Fix · GHSA-fjwp-r6fm-q6qw org.apache.tomcat:tomcat (Maven) Fixed in 9.0.0.M16 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat JBoss Fuse 6
- Red Hat JBoss Web Server 3
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8747
- 2026-10-03 Alias added: GHSA-fjwp-r6fm-q6qw
References
Patch 8
- http://svn.apache.org/viewvc?view=revision&revision=1774161
- http://svn.apache.org/viewvc?view=revision&revision=1774166
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/
Advisory 4
Other 11
- https://github.com/apache/tomcat/commit/452c8094a665ef6375530e81c033da4eeb2e4865
- https://github.com/apache/tomcat/commit/9601a937ff3b7ef5d04b2a0e950d0e44e1bb4cbd
- https://web.archive.org/web/20200227183332/http://www.securityfocus.com/bid/96895
- https://security.netapp.com/advisory/ntap-20180614-0002
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2016-8747 · CVE Program
- CVE-2016-8747 · NVD
- FIRST EPSS
- GHSA-fjwp-r6fm-q6qw · GitHub Advisory Database · CC BY 4.0
- CVE-2016-8747 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences