CVE-2016-8745: Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat
Summary
CVE-2016-8745: Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat. Affects org.apache.tomcat:tomcat across 5 version ranges.
>= 6.0.16, < 6.0.50
>= 7.0.0, < 7.0.75
>= 8.0.0RC1, < 8.0.41
>= 8.5.0, < 8.5.9
>= 9.0.0.M1, < 9.0.0.M14
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a robust and scalable platform for hosting web applications. The vulnerability in Apache Tomcat arises from a bug in the error handling of the send file code for the NIO HTTP connector. This bug allows for concurrent execution using a shared resource with improper synchronization. The bug affects multiple versions of Apache Tomcat, including 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73, and 6.0.16 to 6.0.48.
Vulnerability Detail
The vulnerability occurs when the current Processor object is added to the Processor cache multiple times, allowing for the same Processor to be used for concurrent requests. This sharing of a Processor can result in information leakage between requests, including session ID and response body. The bug was first noticed in version 8.5.x onwards, but further investigation revealed that the bug is present in all currently supported Tomcat versions.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.16, < 6.0.506.0.50 -
>= 7.0.0, < 7.0.757.0.75 -
>= 8.0.0RC1, < 8.0.418.0.41 -
>= 8.5.0, < 8.5.98.5.9 -
>= 9.0.0.M1, < 9.0.0.M149.0.0.M14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Apache Tomcat allows for concurrent execution using a shared resource with improper synchronization, leading to information leakage between requests. It is recommended to upgrade to the fixed versions of Apache Tomcat to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
The vulnerability allows for information leakage between requests, including session ID and response body.
The vulnerability affects versions 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73, and 6.0.16 to 6.0.48.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat.
No specific workaround is mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
