{"cve":"CVE-2017-5647","nvd":{"published":"2017-04-17T16:59:00.320","modified":"2026-06-17T01:20:55.927","status":"Modified","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["http://www.arubanetworks.com/assets/alert/HPESBHF03730.txt","http://www.debian.org/security/2017/dsa-3842","http://www.debian.org/security/2017/dsa-3843","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.securitytracker.com/id/1038218"],"products":["apache:tomcat"],"source":"nvd","synced_at":"2026-10-19T20:42:09.859288039+00:00"},"epss":{"cve":"CVE-2017-5647","score":0.1684,"percentile":0.97044,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-3gv7-3h64-78cm","url":"https://osv.dev/vulnerability/GHSA-3gv7-3h64-78cm","summary":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","modified":"2024-03-19T14:11:25.246843Z","packages":[{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=9.0.0.M1 <9.0.0.M19"],"fixed":["9.0.0.M19"]},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=8.5.0 <8.5.13"],"fixed":["8.5.13"]},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=8.0.0 <8.0.43"],"fixed":["8.0.43"]},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=7.0.0 <7.0.77"],"fixed":["7.0.77"]},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=6.0.0 <6.0.53"],"fixed":["6.0.53"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}