CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-5651
Critical (9.8) in apache tomcat. EPSS 7.8% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat-coyote 8.5.13, 9.0.0.M19.
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
Severity
- EPSS
- 7.8% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9hg2-395j-83rm | Maven | org.apache.tomcat:tomcat-coyote | >=9.0.0.M1 <9.0.0.M19 | 9.0.0.M19 |
| GHSA-9hg2-395j-83rm | Maven | org.apache.tomcat:tomcat-coyote | >=8.5.0 <8.5.13 | 8.5.13 |
| GHSA-9hg2-395j-83rm | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=9.0.0.M1 <9.0.0.M19 | 9.0.0.M19 |
| GHSA-9hg2-395j-83rm | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=8.5.0 <8.5.13 | 8.5.13 |
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.securityfocus.com/bid/97544
- http://www.securitytracker.com/id/1038219
- https://bz.apache.org/bugzilla/show_bug.cgi?id=60918
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E