$ cve CVE-2016-6816 JSON

CVE-2016-6816 EXPLOIT

7.1

HIGH · CVSS 3.0 · EPSS 39.6% (pctl 99)

Patch early

A public exploit exists.

Description

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

Scoring

CVSS	7.1 (HIGH, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS	39.63% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2017-03-20
Last modified	2026-06-17

Affected (1)

Vendor	Product
apache	tomcat

Public exploits

Source	Title	Date
exploit-db	Apache Tomcat 6/7/8/9 - Information Disclosure	2017-04-04

References

→ the Explorer · watch your stack · NVD