CVE-2017-7675
High · 7.5CVSS
7.5
EPSS
10.1%
Published
Aug 11, 2017
CISA due date
—
The record
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | 8.5.0 | 8.5.16 |
| Maven | org.apache.tomcat:tomcat | 9.0.0.M1 | 9.0.0.M22 |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 8.5.0 | No fix |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 9.0.0 | No fix |
| maven | org.apache.tomcat/tomcat | 8.5.0 | No fix |
| maven | org.apache.tomcat/tomcat | 9.0.0.M1 | No fix |
Related vulnerabilities
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects org.apache.tomcat:tomcat
- GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal Also affects org.apache.tomcat:tomcat
- GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Also affects org.apache.tomcat:tomcat
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55754 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects org.apache.tomcat:tomcat
- CVE-2025-49124 Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Also affects org.apache.tomcat:tomcat