CVE-2016-6816

Successful exploitation can enable attacker-controlled HTTP response injection, web-cache poisoning, cross-site scripting, and disclosure of sensitive information associated with other users' requests. The parsing discrepancy may also allow malformed requests to bypass security controls that inspect or normalize HTTP traffic differently from the proxy and backend server.

Ensure front-end proxies, load balancers, web application firewalls, and Tomcat enforce a consistent strict HTTP request grammar and reject invalid request-line characters before forwarding traffic. Avoid configurations in which intermediaries accept or normalize malformed requests differently from the backend. Restrict any compatibility allowance for nonstandard request-target characters to the minimum necessary scope.

Upgrade Apache Tomcat to a fixed release: 9.0.0.M12 or later, 8.5.8 or later, 8.0.39 or later, 7.0.73 or later, or 6.0.48 or later. Apply the applicable vendor update for supported packaged or integrated Tomcat deployments, including Red Hat Enterprise Linux and JBoss products. Following remediation, Tomcat rejects HTTP request characters prohibited by the HTTP specification with HTTP 400 responses; applications that relied on malformed request targets must be corrected. Tomcat provides the tomcat.util.http.parser.HttpParser.requestTargetAllow property for narrowly permitting unencoded curly braces and pipe characters where compatibility requires it.