CVE-2018-1336: Apache Tomcat UTF-8 Decoder Overflow
Summary
CVE-2018-1336: In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder. Affects org.apache.tomcat.embed:tomcat-embed-core across 4 version ranges.
>= 7.0.28, < 7.0.87
>= 8.0.0RC1, < 8.0.51
>= 8.5.0, < 8.5.31
>= 9.0.0.M9, < 9.0.8
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The tomcat-embed-core package is a Maven artifact that allows embedding Tomcat directly into a Java application. This vulnerability affects versions 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86 of the tomcat-embed-core package.
Vulnerability Detail
The vulnerability in Apache Tomcat is related to the UTF-8 decoder's improper handling of overflow with supplementary characters. This flaw can be exploited to trigger an infinite loop in the decoder, leading to a Denial of Service (DoS) condition. An attacker can send specially crafted input to the affected application, causing the decoder to enter an infinite loop and consume excessive CPU resources. This can result in the application becoming unresponsive and unavailable to legitimate users. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2018-1336.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.0.28, < 7.0.877.0.87 -
>= 8.0.0RC1, < 8.0.518.0.51 -
>= 8.5.0, < 8.5.318.5.31 -
>= 9.0.0.M9, < 9.0.89.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions mentioned above.
Conclusion
The vulnerability in Apache Tomcat's UTF-8 decoder can lead to a Denial of Service (DoS) condition. It is crucial to upgrade the tomcat-embed-core package to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
The tomcat-embed-core package is a Maven artifact that allows embedding Tomcat directly into a Java application.
This vulnerability can lead to a Denial of Service (DoS) condition, causing the affected application to become unresponsive and unavailable to legitimate users.
To fix this vulnerability, it is recommended to upgrade the tomcat-embed-core package to the fixed versions mentioned above.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
