CVE-2016-0762: Apache Tomcat

Medium severity, CVSS 5.9. EPSS: 8% chance of exploitation in the next 30 days.

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

Affected products

• Apache Tomcat: from 6.0.0, up to and including 6.0.45; from 7.0.0, up to and including 7.0.70; from 8.0, up to and including 8.0.36; from 8.5.0, up to and including 8.5.4; version 9.0.0 only
• Canonical Ubuntu Linux: version 16.04 only
• Debian Debian Linux: version 8.0 only
• Netapp Oncommand Insight: affected versions not specified
• Netapp Oncommand Shift: affected versions not specified
• Netapp Snap Creator Framework: affected versions not specified
• Oracle Communications Diameter Signaling Router: from 8.0.0, up to and including 8.5.0
• Oracle Tekelec Platform Distribution: from 7.4.0, up to and including 7.7.1
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Eus: version 7.4 only; version 7.5 only; version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.4 only; version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Workstation: version 7.0 only
• Red Hat JBoss Enterprise Web Server: version 3.0.0 only

Published 2017-08-10. Last modified 2026-10-08.