Description

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8747

• http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.11

• http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M17