CVE-2016-6816 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 7.1 High CVSS 3.0 2 scores |
| Fixed in | 9.0.0.M12, 8.5.8, 8.0.39, 7.0.73, 6.0.48 |
| Weakness | Improper input validation (CWE-20) |
| Published | 20 Mar 2017 |
| Updated | 17 Jun 2026 |
Description
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
Exploitation status
Working exploit published
A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2017-04-04.
- EPSS 40% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| Exploit-DB | Apache Tomcat 6/7/8/9 - Information Disclosure | 2017-04-04 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2016-6816.armr patch rule, ARMR 2.6 added 2019-09-03 updated 2026-03-04How to mitigate CVE-2016-6816
Upgrade Apache Tomcat to a release that fixes it: 9.0.0.M12, 8.5.8, 8.0.39, 7.0.73 or 6.0.48. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.1 HIGH
v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
2 metrics
CVSS
7.1 HIGH v3.0CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.0 | 7.1 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
NVD | Primary | published |
| CVSS 2.0 | 6.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat:tomcat-coyote |
9.0.0.M1 | 9.0.0.M12 |
unbounded |
org.apache.tomcat:tomcat-coyote |
8.5.0 | 8.5.8 |
unbounded |
org.apache.tomcat:tomcat-coyote |
8.0.0RC1 | 8.0.39 |
unbounded |
org.apache.tomcat:tomcat-coyote |
7.0.0 | 7.0.73 |
unbounded |
org.apache.tomcat:tomcat-coyote |
6.0.0 | 6.0.48 |
unbounded |
Products and versions
2 products, 183 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | 6.0.0 · 6.0.1 · 6.0.2 · 6.0.3 · 6.0.4 · 6.0.5 · 6.0.6 · 6.0.7 · 6.0.8 · 6.0.9 · 6.0.10 · 6.0.11 · 6.0.12 · 6.0.13 · 6.0.14 · 6.0.15 · 6.0.16 · 6.0.17 · 6.0.18 · 6.0.19 · 6.0.20 · 6.0.21 · 6.0.22 · 6.0.23 · 6.0.24 · 6.0.25 · 6.0.26 · 6.0.27 · 6.0.28 · 6.0.29 · 6.0.30 · 6.0.31 · 6.0.32 · 6.0.33 · 6.0.34 · 6.0.35 · 6.0.36 · 6.0.37 · 6.0.38 · 6.0.39 · 6.0.40 · 6.0.41 · 6.0.42 · 6.0.43 · 6.0.44 · 6.0.45 · 6.0.46 · 6.0.47 · 7.0.0 · 7.0.1 · 7.0.2 · 7.0.3 · 7.0.4 · 7.0.5 · 7.0.6 · 7.0.7 · 7.0.8 · 7.0.9 · 7.0.10 · 7.0.11 · 7.0.12 · 7.0.13 · 7.0.14 · 7.0.15 · 7.0.16 · 7.0.17 · 7.0.18 · 7.0.19 · 7.0.20 · 7.0.21 · 7.0.22 · 7.0.23 · 7.0.24 · 7.0.25 · 7.0.26 · 7.0.27 · 7.0.28 · 7.0.29 · 7.0.30 · 7.0.31 · 7.0.32 · 7.0.33 · 7.0.34 · 7.0.35 · 7.0.36 · 7.0.37 · 7.0.38 · 7.0.39 · 7.0.40 · 7.0.41 · 7.0.42 · 7.0.43 · 7.0.44 · 7.0.45 · 7.0.46 · 7.0.47 · 7.0.48 · 7.0.49 · 7.0.50 · 7.0.51 · 7.0.52 · 7.0.53 · 7.0.54 · 7.0.55 · 7.0.56 · 7.0.57 · 7.0.58 · 7.0.59 · 7.0.60 · 7.0.61 · 7.0.62 · 7.0.63 · 7.0.64 · 7.0.65 · 7.0.66 · 7.0.67 · 7.0.68 · 7.0.69 · 7.0.70 · 7.0.71 · 7.0.72 · 8.0.0 · 8.0.1 · 8.0.2 · 8.0.3 · 8.0.4 · 8.0.5 · 8.0.6 · 8.0.7 · 8.0.8 · 8.0.9 · 8.0.10 · 8.0.11 · 8.0.12 · 8.0.13 · 8.0.14 · 8.0.15 · 8.0.16 · 8.0.17 · 8.0.18 · 8.0.19 · 8.0.20 · 8.0.21 · 8.0.22 · 8.0.23 · 8.0.24 · 8.0.25 · 8.0.26 · 8.0.27 · 8.0.28 · 8.0.29 · 8.0.30 · 8.0.31 · 8.0.32 · 8.0.33 · 8.0.34 · 8.0.35 · 8.0.36 · 8.0.37 · 8.0.38 · 8.5.0 · 8.5.1 · 8.5.2 · 8.5.3 · 8.5.4 · 8.5.5 · 8.5.6 · 9.0.0:milestone1 · 9.0.0:milestone10 · 9.0.0:milestone11 · 9.0.0:milestone2 · 9.0.0:milestone3 · 9.0.0:milestone4 · 9.0.0:milestone5 · 9.0.0:milestone6 · 9.0.0:milestone7 · 9.0.0:milestone8 · 9.0.0:milestone9 |
| osv | org.apache.tomcat | tomcat-coyote | generic | ≥ 6.0.0 and ＜ 6.0.48 · ≥ 7.0.0 and ＜ 7.0.73 · ≥ 8.0.0 and ＜ 8.0.39 · ≥ 8.5.0 and ＜ 8.5.8 · ≥ 9.0.0 and ＜ 9.0.0 |
References
Timeline
Timeline
| Published | 2017-03-20 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2019-09-03 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |