CVE-2016-6817: Apache Tomcat HTTP/2 Header Parser Denial of Service
Summary
CVE-2016-6817: Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 8.5.0, < 8.5.8
>= 9.0.0.M1, < 9.0.0.M12
Fixed in 8.5.8 or 9.0.0.M12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to serve Java-based web applications. It provides a Java HTTP web server environment for running Java code. The HTTP/2 header parser in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 is vulnerable to a denial of service attack. This vulnerability allows an attacker to cause an infinite loop in the header parser by sending a header larger than the available buffer.
Vulnerability Detail
The vulnerability in the HTTP/2 header parser of Apache Tomcat allows an attacker to exploit the improper restriction of operations within the bounds of a memory buffer. By sending a header larger than the available buffer, the parser enters an infinite loop, causing a denial of service attack. This vulnerability can be exploited remotely without authentication. The impact of this vulnerability is a complete denial of service, rendering the affected Apache Tomcat server unresponsive.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.88.5.8 -
>= 9.0.0.M1, < 9.0.0.M129.0.0.M12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a workaround can be implemented by disabling the HTTP/2 protocol in the affected Apache Tomcat server. This can be done by modifying the server configuration to remove the HTTP/2 connector or by disabling the HTTP/2 protocol in the connector configuration. Here is an example of how to disable the HTTP/2 protocol in the connector configuration:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS"/>
By removing the "protocol" attribute or changing it to a non-HTTP/2 protocol, the vulnerability can be mitigated.
Conclusion
The Apache Tomcat HTTP/2 Header Parser Denial of Service vulnerability allows an attacker to cause a denial of service attack by exploiting an infinite loop in the header parser. To mitigate this vulnerability, it is recommended to upgrade to the fixed versions or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
The impact of this vulnerability is a denial of service attack, rendering the affected Apache Tomcat server unresponsive.
Yes, this vulnerability can be exploited remotely without authentication.
Apache Tomcat versions 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 are affected.
To fix this vulnerability, it is recommended to upgrade to Apache Tomcat version 9.0.0.M12 or later for versions 9.x, and version 8.5.8 or later for versions 8.5.x.
Yes, a workaround is available by disabling the HTTP/2 protocol in the affected Apache Tomcat server.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
