CVE-2017-5651

Critical

Published: 17/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, a regression in send file processing was introduced. If the send file processing completed quickly, it was possible for the same Processor to be added to the processor cache twice.

Risk Assessment

This could lead to the same Processor being used for multiple requests, resulting in unexpected errors and/or response mix-up. Organizations may experience issues with data integrity and service reliability.

Recommendation

It is recommended to upgrade to the latest version of Apache Tomcat to eliminate this vulnerability and minimize the risk of request processing errors.

Original NVD description (English source)

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.