In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP…
Priority MEDIUM 53CWE-440Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
Why it matters now
EPSS 0.07752 94th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat-coyote (Maven): 9.0.0.M19, 8.5.13org.apache.tomcat.embed:tomcat-embed-core (Maven): 9.0.0.M19, 8.5.13
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 9.0.0.M1 to 9.0.0.M18; 8.5.0 to 8.5.12 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 9.0.0.M1 to before 9.0.0.M19 | 9.0.0.M19 | Patch available | GHSA-9hg2-395j-83rm |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 8.5.0 to before 8.5.13 | 8.5.13 | Patch available | GHSA-9hg2-395j-83rm |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0.M1 to before 9.0.0.M19 | 9.0.0.M19 | Patch available | GHSA-9hg2-395j-83rm |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.5.0 to before 8.5.13 | 8.5.13 | Patch available | GHSA-9hg2-395j-83rm |
- Apache Tomcat VendorApache Affected 9.0.0.M1 to 9.0.0.M18; 8.5.0 to 8.5.12 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M19 Fixed in 9.0.0.M19 Patch available GHSA-9hg2-395j-83rm
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.5.0 to before 8.5.13 Fixed in 8.5.13 Patch available GHSA-9hg2-395j-83rm
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M19 Fixed in 9.0.0.M19 Patch available GHSA-9hg2-395j-83rm
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.0 to before 8.5.13 Fixed in 8.5.13 Patch available GHSA-9hg2-395j-83rm
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:* | 8.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:* | 8.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:* | 8.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:* | 8.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:* | 8.5.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:* | 8.5.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:* | 8.5.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:* | 8.5.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:* | 8.5.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:* | 8.5.9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:* Versions 8.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:* Versions 8.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:* Versions 8.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:* Versions 8.5.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:* Versions 8.5.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:* Versions 8.5.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:* Versions 8.5.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:* Versions 8.5.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:* Versions 8.5.9 Vulnerable ·Apache
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:* | 8.5.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:* | 8.5.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:* | 8.5.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* | 9.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* | 9.0.0 milestone16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* | 9.0.0 milestone17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* | 9.0.0 milestone18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* | 9.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* | 9.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* | 9.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:* Versions 8.5.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:* Versions 8.5.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:* Versions 8.5.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
Remediation
- Fix · GHSA-9hg2-395j-83rm org.apache.tomcat:tomcat-coyote (Maven) Fixed in 9.0.0.M19 Advisory →
- Fix · GHSA-9hg2-395j-83rm org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.5.13 Advisory →
- Fix · GHSA-9hg2-395j-83rm org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.0.M19 Advisory →
- Fix · GHSA-9hg2-395j-83rm org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.13 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 16 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss BRMS 5
- Red Hat JBoss Data Grid 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Web Server 2
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Operations Network 3
- Red Hat JBoss Portal 6
- Red Hat JBoss SOA Platform 5
- Red Hat JBoss Web Server 3
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5651
- 2026-10-03 Alias added: GHSA-9hg2-395j-83rm
References
Other 27
- https://security.netapp.com/advisory/ntap-20180614-0001/
- [users] 20170410 [SECURITY] CVE-2017-5651 Apache Tomcat Information Disclosure
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/494429ca210641b6b7affe89a2b0a6c0ff70109b
- https://github.com/apache/tomcat/commit/9233d9d6a018be4415d4d7d6cb4fe01176adf1a8
- https://web.archive.org/web/20170420113605/http://www.securitytracker.com/id/1038219
- https://web.archive.org/web/20170417124228/http://www.securityfocus.com/bid/97544
- https://security.netapp.com/advisory/ntap-20180614-0001
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6694538826b87522fb723d2dcedd537e14ebe0a381d92e5525a531d8@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://github.com/search?q=repo%3Aapache%2Ftomcat+apache.coyote+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code
- https://github.com/apache/tomcat
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2017-5651 · CVE Program
- CVE-2017-5651 · NVD
- FIRST EPSS
- GHSA-9hg2-395j-83rm · GitHub Advisory Database · CC BY 4.0
- CVE-2017-5651 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences