CVE-2016-6808
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
9.8 Critical
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
22.7%Up 17.4 points since Feb 4, 2022
What each source reports
NVD Score used
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
- Record
CVE-2016-6808- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
- Record
CVE-2016-6808- Updated
- 2026-11-02
EUVDEUVD-2016-7701 No score
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
- Record
EUVD-2016-7701- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jf5p-rxcp-5pm7
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
- Record
GHSA-jf5p-rxcp-5pm7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVRHSA-2017:0193
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 6
- Record
RHSA-2017:0193- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2017:0194
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 7
- Record
RHSA-2017:0194- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-mod_auth_kerbRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:5.4-35.jbcs.el6 | 0:5.4-35.jbcs.el6 |
jbcs-httpd24-mod_auth_kerb-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:5.4-35.jbcs.el6 | 0:5.4-35.jbcs.el6 |
Show 66 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jbcs-httpd24-mod_bmxRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:0.9.6-14.GA.jbcs.el6 | 0:0.9.6-14.GA.jbcs.el6 |
jbcs-httpd24-mod_bmx-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:0.9.6-14.GA.jbcs.el6 | 0:0.9.6-14.GA.jbcs.el6 |
jbcs-httpd24-mod_bmx-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:0.9.6-14.GA.jbcs.el6 | 0:0.9.6-14.GA.jbcs.el6 |
jbcs-httpd24-mod_cluster-nativeRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.3.5-13.Final_redhat_1.jbcs.el6 | 0:1.3.5-13.Final_redhat_1.jbcs.el6 |
jbcs-httpd24-mod_cluster-native-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.3.5-13.Final_redhat_1.jbcs.el6 | 0:1.3.5-13.Final_redhat_1.jbcs.el6 |
jbcs-httpd24-mod_cluster-native-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.3.5-13.Final_redhat_1.jbcs.el6 | 0:1.3.5-13.Final_redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jk-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jk-manualRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jk-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 1:2.4.23-102.jbcs.el6 | 1:2.4.23-102.jbcs.el6 |
jbcs-httpd24-mod_rtRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.1-16.GA.jbcs.el6 | 0:2.4.1-16.GA.jbcs.el6 |
jbcs-httpd24-mod_rt-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.1-16.GA.jbcs.el6 | 0:2.4.1-16.GA.jbcs.el6 |
jbcs-httpd24-mod_rt-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.1-16.GA.jbcs.el6 | 0:2.4.1-16.GA.jbcs.el6 |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.9.1-18.GA.jbcs.el6 | 0:2.9.1-18.GA.jbcs.el6 |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.9.1-18.GA.jbcs.el6 | 0:2.9.1-18.GA.jbcs.el6 |
jbcs-httpd24-mod_security-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.9.1-18.GA.jbcs.el6 | 0:2.9.1-18.GA.jbcs.el6 |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 1:2.4.23-102.jbcs.el6 | 1:2.4.23-102.jbcs.el6 |
jbcs-httpd24-nghttp2Red Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.12.0-9.jbcs.el6 | 0:1.12.0-9.jbcs.el6 |
jbcs-httpd24-nghttp2-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 0:1.12.0-9.jbcs.el6 | 0:1.12.0-9.jbcs.el6 |
jbcs-httpd24-opensslRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-develRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-libsRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-perlRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-staticRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-src-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-mod_auth_kerbRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:5.4-35.jbcs.el7 | 0:5.4-35.jbcs.el7 |
jbcs-httpd24-mod_auth_kerb-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:5.4-35.jbcs.el7 | 0:5.4-35.jbcs.el7 |
jbcs-httpd24-mod_bmxRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:0.9.6-14.GA.jbcs.el7 | 0:0.9.6-14.GA.jbcs.el7 |
jbcs-httpd24-mod_bmx-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:0.9.6-14.GA.jbcs.el7 | 0:0.9.6-14.GA.jbcs.el7 |
jbcs-httpd24-mod_bmx-src-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:0.9.6-14.GA.jbcs.el7 | 0:0.9.6-14.GA.jbcs.el7 |
jbcs-httpd24-mod_cluster-nativeRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.3.5-13.Final_redhat_1.jbcs.el7 | 0:1.3.5-13.Final_redhat_1.jbcs.el7 |
jbcs-httpd24-mod_cluster-native-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.3.5-13.Final_redhat_1.jbcs.el7 | 0:1.3.5-13.Final_redhat_1.jbcs.el7 |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el7 | 0:1.2.41-14.redhat_1.jbcs.el7 |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el7 | 0:1.2.41-14.redhat_1.jbcs.el7 |
jbcs-httpd24-mod_jk-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el7 | 0:1.2.41-14.redhat_1.jbcs.el7 |
jbcs-httpd24-mod_jk-manualRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.41-14.redhat_1.jbcs.el7 | 0:1.2.41-14.redhat_1.jbcs.el7 |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.23-102.jbcs.el7 | 1:2.4.23-102.jbcs.el7 |
jbcs-httpd24-mod_rtRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.1-16.GA.jbcs.el7 | 0:2.4.1-16.GA.jbcs.el7 |
jbcs-httpd24-mod_rt-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.1-16.GA.jbcs.el7 | 0:2.4.1-16.GA.jbcs.el7 |
jbcs-httpd24-mod_rt-src-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.1-16.GA.jbcs.el7 | 0:2.4.1-16.GA.jbcs.el7 |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.9.1-18.GA.jbcs.el7 | 0:2.9.1-18.GA.jbcs.el7 |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.9.1-18.GA.jbcs.el7 | 0:2.9.1-18.GA.jbcs.el7 |
jbcs-httpd24-mod_security-src-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.9.1-18.GA.jbcs.el7 | 0:2.9.1-18.GA.jbcs.el7 |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.23-102.jbcs.el7 | 1:2.4.23-102.jbcs.el7 |
jbcs-httpd24-nghttp2Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.12.0-9.jbcs.el7 | 0:1.12.0-9.jbcs.el7 |
jbcs-httpd24-nghttp2-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.12.0-9.jbcs.el7 | 0:1.12.0-9.jbcs.el7 |
jbcs-httpd24-opensslRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-libsRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-perlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-staticRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-6808 is a critical vulnerability (CVSS 9.8) in Apache Tomcat Jk Connector, published April 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.7%, the 97th percentile. No source names a fixed version.
References
securitytracker.com/id/1036969
seclists.org/fulldisclosure/2016/Oct/44
access.redhat.com/errata/RHSA-2017:0194
securityfocus.com/bid/93429
rhn.redhat.com/errata/RHSA-2016-2957.html
Show 46 moreShow less
tomcat.apache.org/security-jk.html
packetstormsecurity.com/files/139071/Apache-Tomcat-JK-ISAPI-Connector-1.2.41-Buffer-Overflow.html
openwall.com/lists/oss-security/2016/10/06/4
lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2016-6808
github.com/advisories/GHSA-jf5p-rxcp-5pm7
bugzilla.redhat.com/show_bug.cgi?id=1331402
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0193.json
cve.org/CVERecord?id=CVE-2016-2108
openssl.org/news/secadv/20160503.txt
openssl.org/news/secadv/20160922.txt
eprint.iacr.org/2016/594