VulnerableCode Package Details - pkg:apache/tomcat@8.5.6

Search for packages

Vulnerability	Summary	Fixed by
VCID-3r3s-q21j-c3au Aliases: CVE-2016-6816 GHSA-jc7p-5r39-9477	The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.	8.5.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-95d1-arxd-hkd1 Aliases: CVE-2016-8735 GHSA-cw54-59pw-4g8c	Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.	8.5.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-yxpq-rrry-j3h8 Aliases: CVE-2016-6817 GHSA-698c-2x4j-g9gq	The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.	8.5.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-3r3s-q21j-c3au
Aliases:
CVE-2016-6816
GHSA-jc7p-5r39-9477

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

8.5.8
Affected by 1 other vulnerability.

9.0.0+M13
Affected by 1 other vulnerability.

VCID-95d1-arxd-hkd1
Aliases:
CVE-2016-8735
GHSA-cw54-59pw-4g8c

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

8.5.8
Affected by 1 other vulnerability.

9.0.0+M13
Affected by 1 other vulnerability.

VCID-yxpq-rrry-j3h8
Aliases:
CVE-2016-6817
GHSA-698c-2x4j-g9gq

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

8.5.8
Affected by 1 other vulnerability.

9.0.0+M13
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:12.382009+00:00	Apache Tomcat Importer	Affected by	VCID-3r3s-q21j-c3au	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:12.356239+00:00	Apache Tomcat Importer	Affected by	VCID-yxpq-rrry-j3h8	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:12.327019+00:00	Apache Tomcat Importer	Affected by	VCID-95d1-arxd-hkd1	https://tomcat.apache.org/security-8.html	38.0.0