cveboard RSS feed

CVE-2016-8745

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2016
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Apache Tomcat

Vendor
Apache Software Foundation
Product
Apache Tomcat
Platforms
Unknown
Default status
Unknown
Apache Tomcat · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
9.0.0.M1 to 9.0.0.M13affectedUnavailableUnavailableUnavailableNone listed
8.5.0 to 8.5.8affectedUnavailableUnavailableUnavailableNone listed
8.0.0.RC1 to 8.0.39affectedUnavailableUnavailableUnavailableNone listed
7.0.0 to 7.0.73affectedUnavailableUnavailableUnavailableNone listed
6.0.16 to 6.0.48affectedUnavailableUnavailableUnavailableNone listed