What’s Vulnerable › Vulnerabilities

CVE-2016-6808

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 22.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-04-12 · updated 2026-06-17
• Weakness: CWE-119

Description

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.

Affected products

• Apache Tomcat Jk Connector: before 1.2.42 — fixed in 1.2.42

How to fix

Upgrade to a fixed version: Apache Tomcat Jk Connector 1.2.42. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/139071/Apache-Tomcat-JK-ISAPI-Connector-1.2.41-Buffer-Overflow.html
• http://rhn.redhat.com/errata/RHSA-2016-2957.html
• http://seclists.org/fulldisclosure/2016/Oct/44
• http://tomcat.apache.org/security-jk.html
• http://www.openwall.com/lists/oss-security/2016/10/06/4
• http://www.securityfocus.com/bid/93429
• http://www.securitytracker.com/id/1036969
• https://access.redhat.com/errata/RHSA-2017:0193
• https://access.redhat.com/errata/RHSA-2017:0194
• https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E

Get alerted when CVE-2016-6808 or the next vulnerability affects your stack