Every CVE Search/ Get API key

CVE-2007-6286

Apache Tomcat Does Not Properly Handle Empty Requests

4.3 Medium

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

Exploit likelihood

5.37%Down 2.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

Record
CVE-2007-6286
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE List No score

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

Record
CVE-2007-6286
Updated
2026-11-02
EUVDEUVD-2022-5027 No score

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

Record
EUVD-2022-5027
Updated
2026-11-03
GitHub AdvisoriesGHSA-qrj4-rmqg-4hcp No score

Apache Tomcat Does Not Properly Handle Empty Requests

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

Record
GHSA-qrj4-rmqg-4hcp
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-qrj4-rmqg-4hcp No score

Apache Tomcat Does Not Properly Handle Empty Requests

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

Record
GHSA-qrj4-rmqg-4hcp
Weakness
CWE-200
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 5.5.11 to 5.5.25 None known
org.apache.tomcat:tomcat
Maven
 6.0.0 to 6.0.15 None known

History

History
RecordedChangedSources
aliasesEUVD
affected, aliases, cwes, references, titleGitHub Advisories, OSV
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-6286 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published February 12, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.37%, the 92nd percentile. No source names a fixed version.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open