vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2016-8747

HIGH
7.5
CVSS Score
Published: March 14, 2017 at 09:02 AM UTC
Updated: June 17, 2026 at 12:54 AM UTC
3 products affected across 2 vendorsOnCommand InsightTomcatOncommand Shift

Using Apache Tomcat by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Tomcat - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 7%
SSVC
No known exploit

Description

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Tomcat· Apache
95%
8.5.7 ≤ v ≤ 8.5.98.5.7 ≤ v < 8.5.109.0.0.M11 ≤ v ≤ 9.0.0.M159.0.0 milestone119.0.0 milestone129.0.0 milestone139.0.0 milestone149.0.0 milestone15
OnCommand Insight· NetAppdrupal
95%
All versions
Oncommand Shift· NetApp
95%
All versions

References (12)

x_refsource_CONFIRMIssue TrackingPatchVendor Advisory
Source: [email protected]
http://svn.apache.org/viewvc?view=revision&revision=1774161
x_refsource_CONFIRMIssue TrackingPatchVendor Advisory
Source: [email protected]
http://svn.apache.org/viewvc?view=revision&revision=1774166
x_refsource_CONFIRMRelease NotesVendor Advisory
Source: [email protected]
http://tomcat.apache.org/security-8.html
x_refsource_CONFIRMRelease NotesVendor Advisory
Source: [email protected]
http://tomcat.apache.org/security-9.html
VDB Entryx_refsource_BIDBroken Link
Source: [email protected]
http://www.securityfocus.com/bid/96895
Mailing Listx_refsource_MLISTPatch
Source: [email protected]
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
Mailing Listx_refsource_MLISTPatch
Source: [email protected]
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
Mailing Listx_refsource_MLISTPatch
Source: [email protected]
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHCISA-ADP
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusANALYZED
CWE
CWE-200

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card