CVE-2017-5647

What it actually does

In Apache Tomcat, when the sendfile feature is used with pipelined HTTP requests, the server may deliver responses to the incorrect requests, resulting in information disclosure of response content intended for other clients or sessions.

Why it matters to the business

Organizations using affected Tomcat versions risk exposure of sensitive data in HTTP responses, potentially leading to privacy breaches or compliance violations. Given the age of the vulnerability (over 9 years), most systems should already be updated, but legacy deployments remain at risk.

How an attack unfolds

An attacker sends multiple pipelined HTTP requests to a Tomcat server utilizing sendfile. Due to mishandling, the responses may be mismatched, allowing the attacker to receive sensitive response data meant for other requests.

How to fix it

Upgrade Apache Tomcat to a version beyond the affected ranges: after 9.0.0.M18, 8.5.12, 8.0.42, 7.0.76, or 6.0.52. Disable sendfile if immediate upgrade is not possible.

How to confirm the fix worked

Review Tomcat version and configuration for sendfile usage; test with pipelined requests to ensure correct response mapping.

Typical attack path

1. Identify a Tomcat server using sendfile with pipelined requests enabled
2. Send multiple concurrent pipelined HTTP requests
3. Analyze received responses for data intended for other clients

How to detect it

Examine web server access logs for patterns of pipelined requests and mismatched responses; look for indicators of information leakage in response bodies.

What your security team should do

• Prioritize upgrade of all Tomcat instances to supported versions
• Audit configurations for sendfile feature
• Monitor for unusual response patterns in logs