Read the docs
TI-2018-01237 Aliases CVE-2018-1336GHSA-m59c-jpc8-m2x4

Infinite loop in Apache Tomcat

Priority MEDIUM 58CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 23 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.20354 97th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 9.0.8, 8.5.31, 8.0.51 +1Red Hat: 11 advisoriesRed Hat: 23 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat9.0.0.M9 to 9.0.7; 8.5.0 to 8.5.30; 8.0.0.RC1 to 8.0.51; 7.0.28 to 7.0.86—No fix listedCNA
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.0.M9 to before 9.0.89.0.8Patch availableGHSA-m59c-jpc8-m2x4
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.5.0 to before 8.5.318.5.31Patch availableGHSA-m59c-jpc8-m2x4
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.0.0RC1 to before 8.0.518.0.51Patch availableGHSA-m59c-jpc8-m2x4
—org.apache.tomcat.embed:tomcat-embed-core (Maven)7.0.28 to before 7.0.877.0.87Patch availableGHSA-m59c-jpc8-m2x4
  • Apache Tomcat VendorApache Affected 9.0.0.M9 to 9.0.7; 8.5.0 to 8.5.30; 8.0.0.RC1 to 8.0.51; 7.0.28 to 7.0.86 Fixed in — No fix listed CNA
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0.M9 to before 9.0.8 Fixed in 9.0.8 Patch available GHSA-m59c-jpc8-m2x4
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.0 to before 8.5.31 Fixed in 8.5.31 Patch available GHSA-m59c-jpc8-m2x4
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.0.0RC1 to before 8.0.51 Fixed in 8.0.51 Patch available GHSA-m59c-jpc8-m2x4
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 7.0.28 to before 7.0.87 Fixed in 7.0.87 Patch available GHSA-m59c-jpc8-m2x4

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*7.0.28 – 7.0.86; 8.0.0 – 8.0.51; 8.5.0 – 8.5.30; 9.0.1 – 9.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*8.0.0 rc1VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*8.0.0 rc10VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*8.0.0 rc2VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*8.0.0 rc3VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc4:*:*:*:*:*:*8.0.0 rc4VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*8.0.0 rc5VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc6:*:*:*:*:*:*8.0.0 rc6VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc7:*:*:*:*:*:*8.0.0 rc7VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc8:*:*:*:*:*:*8.0.0 rc8VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.28 – 7.0.86; 8.0.0 – 8.0.51; 8.5.0 – 8.5.30; 9.0.1 – 9.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:* Versions 8.0.0 rc10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:* Versions 8.0.0 rc3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc4:*:*:*:*:*:* Versions 8.0.0 rc4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:* Versions 8.0.0 rc5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc6:*:*:*:*:*:* Versions 8.0.0 rc6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc7:*:*:*:*:*:* Versions 8.0.0 rc7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc8:*:*:*:*:*:* Versions 8.0.0 rc8 Vulnerable ·Apache
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:8.0.0:rc9:*:*:*:*:*:*8.0.0 rc9VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*9.0.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*9.0.0 milestone11VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*9.0.0 milestone12VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*9.0.0 milestone13VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*9.0.0 milestone14VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*9.0.0 milestone15VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*9.0.0 milestone16VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*9.0.0 milestone17VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*9.0.0 milestone18VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*9.0.0 milestone19VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*9.0.0 milestone20VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*9.0.0 milestone21VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*9.0.0 milestone22VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*9.0.0 milestone23VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*9.0.0 milestone24VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*9.0.0 milestone25VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*9.0.0 milestone26VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*9.0.0 milestone27VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*9.0.0 milestone9VulnerableApache
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableRed Hat
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_web_server:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:apache:tomcat:8.0.0:rc9:*:*:*:*:*:* Versions 8.0.0 rc9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_web_server:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-m59c-jpc8-m2x4 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.8 Advisory →
  • Fix · GHSA-m59c-jpc8-m2x4 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.31 Advisory →
  • Fix · GHSA-m59c-jpc8-m2x4 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.0.51 Advisory →
  • Fix · GHSA-m59c-jpc8-m2x4 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.87 Advisory →

Red Hat 11 advisories

  • RHSA-2018:3768 Released 2018-12-04 · Red Hat rating Important
    Red Hat Fuse 7.2 security update
    • Red Hat Fuse 7.2
  • RHSA-2018:2945 Released 2018-10-18 · Red Hat rating Important
    Red Hat OpenShift Application Runtimes Spring Boot 1.5.16 update
    • Text-Only RHOAR
  • RHSA-2018:2939 Released 2018-10-17 · Red Hat rating Critical
    Red Hat FIS 2.0 on Fuse 6.3.0 R8 security and bug fix update
    • Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8
Show 8 more Red Hat advisories
  • RHSA-2018:2930 Released 2018-10-16 · Red Hat rating Important
    Red Hat JBoss Operations Network 3.3.11 security and bug fix update
    • Red Hat JBoss Operations Network 3.3
  • RHSA-2018:2921 Released 2018-10-16 · Red Hat rating Important
    tomcat security update
    • Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-8.el7_5, tomcat-servlet-3.0-api-7.0.76-8.el7_5
    • Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-8.el7_5, tomcat-admin-webapps-7.0.76-8.el7_5, tomcat-docs-webapp-7.0.76-8.el7_5 +6
    • Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-8.el7_5, tomcat-servlet-3.0-api-7.0.76-8.el7_5
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-8.el7_5, tomcat-admin-webapps-7.0.76-8.el7_5, tomcat-docs-webapp-7.0.76-8.el7_5 +6
    • Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-8.el7_5, tomcat-admin-webapps-7.0.76-8.el7_5, tomcat-el-2.2-api-7.0.76-8.el7_5 +4
    • Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-8.el7_5, tomcat-admin-webapps-7.0.76-8.el7_5, tomcat-docs-webapp-7.0.76-8.el7_5 +6
    • Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-8.el7_5, tomcat-admin-webapps-7.0.76-8.el7_5, tomcat-el-2.2-api-7.0.76-8.el7_5 +4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-8.el7_5, tomcat-javadoc-7.0.76-8.el7_5, tomcat-jsvc-7.0.76-8.el7_5
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) tomcat-7.0.76-8.el7_5, tomcat-admin-webapps-7.0.76-8.el7_5, tomcat-el-2.2-api-7.0.76-8.el7_5 +4
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) tomcat-7.0.76-8.el7_5, tomcat-admin-webapps-7.0.76-8.el7_5, tomcat-docs-webapp-7.0.76-8.el7_5 +6
  • RHSA-2018:2743 Released 2018-09-24 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.21 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el6 +47
  • RHSA-2018:2742 Released 2018-09-24 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.21 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el5 +47
  • RHSA-2018:2741 Released 2018-09-24 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.21 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el7, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el7 +47
  • RHSA-2018:2740 Released 2018-09-24 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.21 security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2018:2701 Released 2018-09-12 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 Service Pack 5 security and bug fix update
    • Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat7-7.0.70-29.ep7.el6, tomcat7-admin-webapps-7.0.70-29.ep7.el6, tomcat7-docs-webapp-7.0.70-29.ep7.el6 +21
    • Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat7-7.0.70-29.ep7.el7, tomcat7-admin-webapps-7.0.70-29.ep7.el7, tomcat7-docs-webapp-7.0.70-29.ep7.el7 +21
  • RHSA-2018:2700 Released 2018-09-12 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 Service Pack 5 security and bug fix update
    • Red Hat JBoss Web Server 3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tomcat — USN-3723-1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2018-05811 Improper certificate validation in Apache TomcatPriority MEDIUM 58
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix yet
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2018:2921
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2018:2921
Red Hat Fuse 7.2Fixed RHSA-2018:3768
Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8Fixed RHSA-2018:2939
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2018:2740
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2018:2742
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2018:2743
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2018:2741
Red Hat JBoss Operations Network 3.3Fixed RHSA-2018:2930
Red Hat JBoss Web Server 3.1Fixed RHSA-2018:2700
Red Hat JBoss Web Server 3.1 for RHEL 6Fixed RHSA-2018:2701
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2018:2701
Red Hat JBoss Web Server 5.0 for RHEL 6 ServerFixed—
Red Hat JBoss Web Server 5.0 for RHEL 7 ServerFixed—
Text-Only RHOARFixed RHSA-2018:2945
Not affected: 12 products
  • Red Hat BPM Suite 6
  • Red Hat Enterprise Linux 6
  • Red Hat JBoss BRMS 5
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 5
  • Red Hat JBoss Enterprise Web Server 2
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss SOA Platform 5
  • Red Hat JBoss Web Server 5
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1336
  2. 2026-10-03 Alias added: GHSA-m59c-jpc8-m2x4

References

Advisory 19

Other 44

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences