CVE-2017-5647: Apache Tomcat - Exposure of Sensitive Information to an Unauthorized Actor
Summary
CVE-2017-5647: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat. Affects org.apache.tomcat:tomcat across 5 version ranges.
>= 6.0.0, < 6.0.53
>= 7.0.0, < 7.0.77
>= 8.0.0, < 8.0.43
>= 8.5.0, < 8.5.13
>= 9.0.0.M1, < 9.0.0.M19
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. However, a vulnerability has been discovered in Apache Tomcat that could potentially expose sensitive information to unauthorized actors.
Vulnerability Detail
The vulnerability exists in the handling of pipelined requests in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52. When the 'send file' feature is used, there is a bug that causes the pipelined request to be lost after the completion of send file processing for the previous request. This can lead to responses being sent for the wrong request, potentially exposing sensitive information to unauthorized actors. For example, a user agent that sends requests A, B, and C may receive the response for request C as the response for request B, and no response for request C.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.536.0.53 -
>= 7.0.0, < 7.0.777.0.77 -
>= 8.0.0, < 8.0.438.0.43 -
>= 8.5.0, < 8.5.138.5.13 -
>= 9.0.0.M1, < 9.0.0.M199.0.0.M19
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Apache Tomcat could potentially expose sensitive information to unauthorized actors. It is recommended to upgrade to the fixed versions of Apache Tomcat to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
The vulnerability could potentially expose sensitive information to unauthorized actors, leading to a breach of confidentiality.
The vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat.
No specific workaround has been mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
