HighVulnerability

CVE-2017-6056

Apache Tomcat HTTPS Request Processing Infinite-Loop Denial of Service

Published Feb 17, 2017 · Updated 15 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS7.5High · v3

EPSS7.6%95th percentile

CISA KEVNoNot listed

In the wildNoneNo exploitation reported

Vendors: Debian ProjectCanonical

IdentifiersCVE-2017-6056CWE-835 · Loop with Unreachable Exit…

CVE-2017-6056 is a denial-of-service vulnerability in Apache Tomcat's servlet and JSP engine caused by a programming error in HTTPS request processing. The error can place request processing into an infinite loop. The condition affects Tomcat versions in which the fix for CVE-2016-6816 was backported without also including the earlier corrective change for Tomcat Bug 57544. Upstream incorporated the Bug 57544 fix in Tomcat 8.0.19, 7.0.60, and 6.0.44.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An unauthenticated remote attacker can trigger an infinite processing loop through HTTPS requests, consuming server resources and causing prolonged response times or complete denial of service. The documented impact is limited to availability; no confidentiality or integrity impact is stated. Red Hat assigned CVSS v3.0 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Mitigation

If you can’t patch tonight, do this now.

Until an update can be deployed, restrict untrusted access to the affected HTTPS service using network access controls or a reverse proxy, and monitor Tomcat CPU consumption, request-processing latency, and worker-thread saturation for potential infinite-loop conditions. Restarting the affected service may restore availability after exploitation but does not remediate the flaw.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-supported Tomcat or product release that includes the corrective change for Tomcat Bug 57544 in addition to the CVE-2016-6816 fix. For Red Hat JBoss Enterprise Application Platform 6, upgrade from the affected 6.4.13 release to 6.4.14 using the applicable Red Hat security update. Ensure any locally maintained backport of CVE-2016-6816 also includes the Bug 57544 correction.

Public exploits

Exploits

No public exploits tracked yet. Mallory keeps watching.

View more in app →

No public exploit code observed for this vulnerability. Mallory keeps watching.

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

CanonicalUbuntu Linuxoperating_system

Debian ProjectDebian Linuxoperating_system

External references

References

Activity feed

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

rhn redhatNews · Jan 1, 2026RHSA-2017:0828 - Security Advisory - Red Hat Customer PortalA denial-of-service vulnerability in Apache Tomcat HTTPS request processing that can cause an infinite loop.Read more ↗rhn redhatNews · Jan 1, 2026RHSA-2017:0826 - Security Advisory - Red Hat Customer PortalA denial-of-service vulnerability in Apache Tomcat's HTTPS request processing that can cause an infinite loop.Read more ↗rhn redhatNews · Jan 1, 2026RHSA-2017:0517 - Security Advisory - Red Hat Customer PortalA denial-of-service vulnerability in Apache Tomcat HTTPS request processing that can cause an infinite loop.Read more ↗rhn redhatNews · Jan 1, 2026RHSA-2017:0829 - Security Advisory - Red Hat Customer PortalA denial-of-service flaw in Apache Tomcat's processing of HTTPS requests, where a programming error can result in an infinite loop.Read more ↗

+5 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.

HighVulnerability

CVE-2017-6056

Apache Tomcat HTTPS Request Processing Infinite-Loop Denial of Service

Published Feb 17, 2017 · Updated 15 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS7.5High · v3

EPSS7.6%95th percentile

CISA KEVNoNot listed

In the wildNoneNo exploitation reported

Vendors: Debian ProjectCanonical

IdentifiersCVE-2017-6056CWE-835 · Loop with Unreachable Exit…

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Mitigation

If you can’t patch tonight, do this now.

Remediation

Patch, then assume compromise.

Public exploits

Exploits

No public exploits tracked yet. Mallory keeps watching.

View more in app →

No public exploit code observed for this vulnerability. Mallory keeps watching.

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

CanonicalUbuntu Linuxoperating_system

Debian ProjectDebian Linuxoperating_system

External references

References

Activity feed

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

+5 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.