{"id":"CVE-2016-8745","description":"A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.","cvssScore":7.5,"cvssVersion":"3.0","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssMetrics":[{"version":"3.0","score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"cwes":["CWE-388","CWE-362"],"resolved":"NO-EXPLOIT-PUBLISHED","published":"2017-08-10","lastModified":"2026-06-17","affectedProducts":[{"vendor":"apache","product":"tomcat","version":"7.0.0"},{"vendor":"apache","product":"tomcat","version":"7.0.1"},{"vendor":"apache","product":"tomcat","version":"7.0.2"},{"vendor":"apache","product":"tomcat","version":"7.0.3"},{"vendor":"apache","product":"tomcat","version":"7.0.4"},{"vendor":"apache","product":"tomcat","version":"7.0.5"},{"vendor":"apache","product":"tomcat","version":"7.0.6"},{"vendor":"apache","product":"tomcat","version":"7.0.7"},{"vendor":"apache","product":"tomcat","version":"7.0.8"},{"vendor":"apache","product":"tomcat","version":"7.0.9"},{"vendor":"apache","product":"tomcat","version":"7.0.11"},{"vendor":"apache","product":"tomcat","version":"7.0.12"},{"vendor":"apache","product":"tomcat","version":"7.0.13"},{"vendor":"apache","product":"tomcat","version":"7.0.14"},{"vendor":"apache","product":"tomcat","version":"7.0.15"},{"vendor":"apache","product":"tomcat","version":"7.0.16"},{"vendor":"apache","product":"tomcat","version":"7.0.17"},{"vendor":"apache","product":"tomcat","version":"7.0.18"},{"vendor":"apache","product":"tomcat","version":"7.0.19"},{"vendor":"apache","product":"tomcat","version":"7.0.20"}],"totalAffectedProducts":1,"references":[{"url":"https://github.com/apache/tomcat/commit/143bb466cf96a89e791b7db5626055ea819dad89","source":"osv","tags":["WEB"]},{"url":"https://github.com/apache/tomcat/commit/16a57bc885e212839f1d717b94b01d154a36943a","source":"osv","tags":["WEB"]},{"url":"https://github.com/apache/tomcat/commit/cbc9b18a845d3c8c053ac293dffda6c6c19dd92b","source":"osv","tags":["WEB"]},{"url":"https://github.com/apache/tomcat80/commit/3dd2fec73e0de1edc1d3eb1c52a01255fdfc84e7","source":"osv","tags":["WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0455","source":"osv","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","source":"osv","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E","source":"osv","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","source":"osv","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E","source":"osv","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","source":"osv","tags":["WEB"]}],"reasoning":{"decidingSource":"no-exploit-published","decidingReason":"This CVE is not listed in CISA KEV, CISA Vulnrichment records no active exploitation, and no reviewed exploit catalogue carries an entry for it. Nobody has published something a stranger can run, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Maven packages: org.apache.tomcat:tomcat-util"},{"rule":"patch-hint","stage":"disposition","outcome":"no-match"},{"rule":"open-source-maven","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"Open-source Maven artifact indexed by OSV (Maven packages: org.apache.tomcat:tomcat-util). The source is public, which makes an ARMR patch rule a candidate; nothing here establishes that one can be written."},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"no-match"},{"rule":"below-action-threshold","stage":"disposition","outcome":"no-match","detail":"Severity is HIGH — only MEDIUM/LOW are deprioritized"},{"rule":"no-exploit-published","stage":"disposition","outcome":"matched","status":"NO-EXPLOIT-PUBLISHED","detail":"No working exploit has been published, and an upstream fix path does exist, so the remediation half of the candidacy still holds.","decisive":true}],"affectedProducts":[{"vendor":"apache","product":"tomcat","isKnown":true,"cpe":"cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*","source":"yaml"}],"affectedPackages":[{"name":"org.apache.tomcat:tomcat-util","introduced":"9.0.0.M1","fixed":"9.0.0.M14"},{"name":"org.apache.tomcat:tomcat-util","introduced":"8.5.0","fixed":"8.5.9"},{"name":"org.apache.tomcat:tomcat-util","introduced":"8.0.0-RC1","fixed":"8.0.41"},{"name":"org.apache.tomcat:tomcat-util","introduced":"7.0.0","fixed":"7.0.75"},{"name":"org.apache.tomcat:tomcat-util","introduced":"6.0.16","fixed":"6.0.50"}]},"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"unverified","type":"patch-rule"},"review":{"state":"automated","basis":"upstream-data"}},"signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.16038,"percentile":0.96723},"ssvc":{"available":true,"exploitation":"none","automatable":"yes","technicalImpact":"partial"}}