CVE-2016-6817

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.6 Apache Tomcat versions 9.0.0.M1 through 9.0.0.M11

Description The HTTP/2 header parser in Apache Tomcat entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

Recommendations For Apache Tomcat versions 8.5.0 through 8.5.6, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 9.0.0.M1 through 9.0.0.M11, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the size of HTTP/2 headers to prevent the infinite loop condition.