CVE catalog

CVE-2016-6816

tomcat9: CVE-2016-6816

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
39.63% · Oct 25, 2026

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantomcat9sid9.0.122-1not affected
Debiantomcat9forky9.0.122-1not affected
Debiantomcat9trixie9.0.95-1not affected
Debiantomcat9bookworm9.0.70-2not affected
Ubuntutomcat714.047.0.42-1vulnerable
Ubuntutomcat714.047.0.47-1vulnerable
Ubuntutomcat714.047.0.50-1vulnerable
Ubuntutomcat714.047.0.52-1vulnerable
Ubuntutomcat714.047.0.52-1ubuntu0.1vulnerable
Ubuntutomcat714.047.0.52-1ubuntu0.3vulnerable
Ubuntutomcat714.047.0.52-1ubuntu0.6vulnerable
Ubuntutomcat714.047.0.52-1ubuntu0.7vulnerable
Ubuntutomcat714.047.0.52-1ubuntu0.8fixed
Ubuntutomcat6pro6.0.37-1vulnerable
Ubuntutomcat6pro6.0.39-1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm1vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm2vulnerable
Ubuntutomcat6pro6.0.39-1ubuntu0.1+esm3vulnerable
Ubuntutomcat616.046.0.41-4vulnerable
Ubuntutomcat616.046.0.45+dfsg-1vulnerable
Ubuntutomcat616.046.0.45+dfsg-1ubuntu0.1fixed
Ubuntutomcat716.047.0.64-1vulnerable
Ubuntutomcat716.047.0.68-1vulnerable
Ubuntutomcat716.047.0.68-1ubuntu0.1vulnerable
Ubuntutomcat716.047.0.68-1ubuntu0.3fixed
Ubuntutomcat816.048.0.26-1vulnerable
Ubuntutomcat816.048.0.28-1vulnerable
Ubuntutomcat816.048.0.30-1vulnerable
Ubuntutomcat816.048.0.32-1vulnerable
Ubuntutomcat816.048.0.32-1ubuntu1vulnerable
Ubuntutomcat816.048.0.32-1ubuntu1.1vulnerable
Ubuntutomcat816.048.0.32-1ubuntu1.2vulnerable
Ubuntutomcat816.048.0.32-1ubuntu1.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantomcat9sourcesidNot affectedunimportantNot reportedNot reported
Debiantomcat9sourceforkyNot affectedunimportantNot reportedNot reported
Debiantomcat9sourcetrixieNot affectedunimportantNot reportedNot reported
Debiantomcat9sourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntutomcat7deb14.047.0.52-1ubuntu0.8Not reportedUBUNTU-CVE-2016-6816Not reported
Ubuntutomcat6deb16.046.0.45+dfsg-1ubuntu0.1Not reportedUBUNTU-CVE-2016-6816Not reported
Ubuntutomcat7deb16.047.0.68-1ubuntu0.3Not reportedUBUNTU-CVE-2016-6816Not reported
Ubuntutomcat8deb16.048.0.32-1ubuntu1.3Not reportedUBUNTU-CVE-2016-6816Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libtomcat9-java]Not affected

    Source package: [tomcat9]

    Details (2)

    • 9.0.70-2 · all · bookworm

      Not affected

      dsa · tomcat9 · debian · bookworm

    • 9.0.70-2 · all · bookworm

      Not affected

      dsa · tomcat9 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]