CVE-2017-6056

What it actually does

A programming error introduced during backporting of an earlier HTTPS request handling fix causes an infinite loop when processing certain HTTPS requests in the Tomcat servlet/JSP engine, resulting in denial of service.

Why it matters to the business

An unauthenticated remote attacker can render Tomcat-based web applications unavailable, causing operational downtime for any services relying on the affected Debian or Ubuntu distributions until the service is restarted or the system is patched.

How an attack unfolds

An attacker sends a specially crafted HTTPS request that triggers the incomplete backport logic; the server enters an infinite loop consuming CPU and blocking the worker thread, with no authentication or special privileges required.

How to fix it

Upgrade Tomcat packages to versions that include the complete fix for Tomcat bug 57544; for Debian jessie use at least 7.0.56-3+deb8u8 or 8.0.14-1+deb8u7, and apply the corresponding Ubuntu updates that resolve the backporting issue.

How to confirm the fix worked

Confirm Tomcat version after upgrade, review release notes for inclusion of the 57544 fix, and test that previously triggering HTTPS requests no longer cause looping behavior under load.

Typical attack path

1. Identify a reachable Tomcat instance on an affected Debian or Ubuntu host
2. Craft and transmit a malicious HTTPS request exploiting the backport gap
3. Observe the target thread enter an infinite loop and service degradation
4. Repeat requests to sustain or amplify the denial of service

How to detect it

Review web server access logs for repeated identical HTTPS requests from the same source, monitor process CPU utilization for sudden sustained spikes on Tomcat worker threads, and correlate with service availability alerts.

What your security team should do

• Prioritize patching all Debian and Ubuntu systems running Tomcat to the versions listed in the remediation guidance
• Monitor EPSS trend and re-evaluate exposure if exploit maturity increases
• Implement network-level rate limiting or WAF rules for HTTPS endpoints as a temporary control