CVE-2007-6286
Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
- EPSS
- 5.4% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qrj4-rmqg-4hcp | Maven | org.apache.tomcat:tomcat | >=5.5.11 <=5.5.25 | no fix published |
| GHSA-qrj4-rmqg-4hcp | Maven | org.apache.tomcat:tomcat | >=6.0.0 <=6.0.15 | no fix published |