CVE-2017-5664
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
Apache Tomcat versions 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43, and 7.0.0 to 7.0.77 do not process static error pages as GET requests when an error occurs. Depending on the original request, this can lead to unexpected results, including replacement or removal of custom error pages if the DefaultServlet is configured to permit writes.
Risk Assessment
An attacker could exploit this vulnerability to modify or delete error pages, potentially leading to information disclosure or further attacks.
Recommendation
Update Apache Tomcat to a version later than 9.0.0.M20, 8.5.14, 8.0.43, or 7.0.77, which contain the fix.
Other vulnerabilities in Apache Tomcat
See all- CVE-2025-48989High
A vulnerability in Apache Tomcat related to improper resource shutdown or release allows for a 'made you reset' attack. This affects versions from 11.0.0-M1 to 11.0.9, from 10.1.0-M1 to 10.1.43, and from 9.0.0.M1 to 9.0.107.
- CVE-2017-7675High
The HTTP/2 implementation in Apache Tomcat from version 9.0.0.M1 to 9.0.0.M21 and from 8.5.0 to 8.5.15 bypassed several security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
- CVE-2016-6817High
The HTTP/2 header parser in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header larger than the available buffer was received. This made a denial of service attack possible.
- CVE-2017-5650High
In Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame did not close streams associated with that connection waiting for a WINDOW_UPDATE, potentially leading to exhaustion of available processing threads.
- CVE-2016-6816High
The code in Apache Tomcat versions from 6.0.0 to 9.0.0.M11 allowed parsing of the HTTP request line with invalid characters. This could be exploited in conjunction with a proxy that also accepted these characters to inject data into the HTTP response.
- CVE-2017-6056High
A programming error was discovered in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine, which may result in denial of service due to an infinite loop. This issue arises from backporting the CVE-2016-6816 fix without including the fix for Tomcat bug 57544.
- CVE-2026-103119Critical
A buffer under-read vulnerability in Apache Tomcat means a large non-blocking write could result in the response body being split between the current request and the next request on that connection, most likely causing failure of the second request and possible leakage of data from the first response to the second.
- CVE-2026-101356Critical
Incorrect object recycling and reuse in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. Affects versions 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122.
- CVE-2026-101296Critical
A missing critical authentication step in Apache Tomcat when the JNDI realm was configured with a non-GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. Affects versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122; EOL versions 8.5.0-8.5.100 and 7.0.0-7.0.109 are also known to be affected.
- CVE-2026-86350Critical
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Original NVD description (English source)
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS