CVE-2016-6816

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Apache Software FoundationApache Tomcat9.0.0.M1 to 9.0.0.M11; 8.5.0 to 8.5.6; 8.0.0.RC1 to 8.0.38; 7.0.0 to 7.0.72; 6.0.0 to 6.0.47; Earlier, unsupported versions may also be affected.

References

Timeline

Published
Mar 20, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-68177.5The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that waCVE-2016-68189.8SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive informatioCVE-2016-68207.5MetroCluster Tiebreaker for clustered Data ONTAP in versions before 1.2 discloses sensitive information in cleartext which may be viewed by CVE-2016-68237.5Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted heCVE-2016-68246.5Huawei AC6003, AC6005, AC6605, and ACU2 access controllers with software before V200R006C10SPC200 allows remote authenticated users to causeCVE-2016-68259.8Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPCVE-2016-68266.5Huawei AnyMail before 2.6.0301.0060 allows remote attackers to cause a denial of service (application crash) via a crafted compressed email CVE-2016-68276.5Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain sensitiCVE-2016-68285.5The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after aCVE-2016-68299.8The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-tCVE-2016-68309.8The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment varCVE-2016-68317.5The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak
CVE-2016-6816: High severity, CVSS 7.1 | Vulnix