CVE-2016-6817

🗓️ 10 Aug 2017 22:00:00Reported by apacheType

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible

Reporter	Title	Published	Views	Family All 47
IBM Security Bulletins	Security Bulletin: Apache Tomcat vulnerability affects IBM Storwize V7000 Unified (CVE-2016-6816, CVE-2016-6817, CVE-2016-8735 )	18 Jun 201800:32	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Apache Tomcat Vulnerabilities (CVE-2016-6817, CVE-2016-8735, CVE-2016-6816)	15 Nov 201822:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Apache Tomcat vulnerabilities affect IBM SONAS.	18 Jun 201800:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat affect Power Hardware Management Console (CVE-2016-6816, CVE-2016-6817, and CVE-2016-0762)	23 Sep 202101:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat affect the IBM FlashSystem model V840	18 Jun 201800:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat affect the IBM FlashSystem models 840 and 900	18 Feb 202301:45	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in IBM Java Runtime and Apache Tomcat that affect IBM Cognos Business Viewpoint	15 Jun 201823:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect SAN Volume Controller, Storwize family and FlashSystem V9000 products	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin: OpenSSL vulnerabilities affect IBM Rational Team Concert (CVE-2016-1240, CVE-2016-6797, etc)	28 Apr 202118:35	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities in Apache Tomcat and OpenSSL affect Rational BuildForge	17 Jun 201805:18	–	ibm

NVD

Vulners

Node

apache tomcatMatch8.5.0

apache tomcatMatch8.5.1

apache tomcatMatch8.5.2

apache tomcatMatch8.5.3

apache tomcatMatch8.5.4

apache tomcatMatch8.5.5

apache tomcatMatch8.5.6

apache tomcatMatch9.0.0milestone1

apache tomcatMatch9.0.0milestone10

apache tomcatMatch9.0.0milestone11

apache tomcatMatch9.0.0milestone2

apache tomcatMatch9.0.0milestone3

apache tomcatMatch9.0.0milestone4

apache tomcatMatch9.0.0milestone5

apache tomcatMatch9.0.0milestone6

apache tomcatMatch9.0.0milestone7

apache tomcatMatch9.0.0milestone8

apache tomcatMatch9.0.0milestone9

[
  {
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0.M1 to 9.0.0.M11"
      },
      {
        "status": "affected",
        "version": "8.5.0 to 8.5.6"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/94462
securitytracker	www.securitytracker.com/id/1037330
lists	www.lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
lists	www.lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
lists	www.lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
lists	www.lists.apache.org/thread.html/a9f24571460af003071475b75f18cad81ebcc36fa7c876965a75e32a%40%3Cannounce.tomcat.apache.org%3E
lists	www.lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
security	www.security.netapp.com/advisory/ntap-20180607-0001/

13 May 2026 00:24Current

8High risk

Vulners AI Score8

CVSS 25

CVSS 37.5

CVSS 3.17.5

EPSS0.00759

SSVC