High severity8.1NVD Advisory· Published Feb 25, 2016· Updated May 6, 2026

CVE-2015-5346

Description

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.tomcat:tomcatMaven	>= 9.0.0.M1, < 9.0.0.M2	9.0.0.M2
org.apache.tomcat:tomcatMaven	>= 8.0.0.RC1, < 8.0.31	8.0.31
org.apache.tomcat:tomcatMaven	>= 7.0.0, < 7.0.66	7.0.66

Affected products

Apache/Tomcat66 versions
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*+ 65 more
- cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
Canonical (company)/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Debian/Debian Linux2 versions
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Patches

c39b7ffc2145

Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=58809

https://github.com/apache/tomcat80Mark ThomasJan 7, 2016via ghsa

commit

3 files changed · +16 −4

java/org/apache/catalina/connector/CoyoteAdapter.java+1 −1 modified

@@ -951,8 +951,8 @@ protected boolean postParseRequest(org.apache.coyote.Request req, Request reques
                                 // Recycle cookies and session info in case the
                                 // correct context is configured with different
                                 // settings
-                                req.getCookies().recycle();
                                 request.recycleSessionInfo();
+                                request.recycleCookieInfo(true);
                             }
                             break;
                         }

java/org/apache/catalina/connector/Request.java+11 −3 modified

@@ -477,8 +477,6 @@ public void recycle() {
             parts = null;
         }
         partsParseException = null;
-        cookiesParsed = false;
-        cookiesConverted = false;
         locales.clear();
         localesParsed = false;
         secure = false;
@@ -492,9 +490,9 @@ public void recycle() {
         attributes.clear();
         sslAttributesParsed = false;
         notes.clear();
-        cookies = null;
 
         recycleSessionInfo();
+        recycleCookieInfo(false);
 
         if (Globals.IS_SECURITY_ENABLED || Connector.RECYCLE_FACADES) {
             parameterMap = new ParameterMap<>();
@@ -554,6 +552,16 @@ protected void recycleSessionInfo() {
     }
 
 
+    protected void recycleCookieInfo(boolean recycleCoyote) {
+        cookiesParsed = false;
+        cookiesConverted = false;
+        cookies = null;
+        if (recycleCoyote) {
+            getCoyoteRequest().getCookies().recycle();
+        }
+    }
+
+
     public boolean read() throws IOException {
         return (inputBuffer.realReadBytes(null, 0, 0) > 0);
     }

webapps/docs/changelog.xml+4 −0 modified

@@ -114,6 +114,10 @@
         Fix declaration of <code>localPort</code> attribute of Connector MBean:
         it is read-only. (kkolinko)
       </fix>
+      <fix>
+        <bug>58809/bug>: Correctly recycle cookies when mapping requests for
+        parallel deployment. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">

04164c1f01b9

Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=58809

https://github.com/apache/tomcatMark ThomasJan 6, 2016via ghsa

commit

2 files changed · +12 −4

java/org/apache/catalina/connector/CoyoteAdapter.java+1 −1 modified

@@ -719,8 +719,8 @@ protected boolean postParseRequest(org.apache.coyote.Request req, Request reques
                                 // Recycle cookies and session info in case the
                                 // correct context is configured with different
                                 // settings
-                                req.getCookies().recycle();
                                 request.recycleSessionInfo();
+                                request.recycleCookieInfo(true);
                             }
                             break;
                         }

java/org/apache/catalina/connector/Request.java+11 −3 modified

@@ -452,8 +452,6 @@ public void recycle() {
             parts = null;
         }
         partsParseException = null;
-        cookiesParsed = false;
-        cookiesConverted = false;
         locales.clear();
         localesParsed = false;
         secure = false;
@@ -467,9 +465,9 @@ public void recycle() {
         attributes.clear();
         sslAttributesParsed = false;
         notes.clear();
-        cookies = null;
 
         recycleSessionInfo();
+        recycleCookieInfo(false);
 
         if (Globals.IS_SECURITY_ENABLED || Connector.RECYCLE_FACADES) {
             parameterMap = new ParameterMap<>();
@@ -520,6 +518,16 @@ protected void recycleSessionInfo() {
     }
 
 
+    protected void recycleCookieInfo(boolean recycleCoyote) {
+        cookiesParsed = false;
+        cookiesConverted = false;
+        cookies = null;
+        if (recycleCoyote) {
+            getCoyoteRequest().getCookies().recycle();
+        }
+    }
+
+
     // -------------------------------------------------------- Request Methods
 
     /**

6287be37d8d0

Handle the unlikely case where different versions of a web application are deployed with different session settings

https://github.com/apache/tomcatMark ThomasNov 7, 2015via ghsa

commit

3 files changed · +26 −17

java/org/apache/catalina/connector/CoyoteAdapter.java+3 −0 modified

@@ -781,6 +781,9 @@ protected boolean postParseRequest(org.apache.coyote.Request req,
                                 // Reset mapping
                                 request.getMappingData().recycle();
                                 mapRequired = true;
+                                // Recycle session info in case the correct
+                                // context is configured with different settings
+                                request.recycleSessionInfo();
                             }
                             break;
                         }

java/org/apache/catalina/connector/Request.java+19 −17 modified

@@ -500,18 +500,7 @@ public void recycle() {
         notes.clear();
         cookies = null;
 
-        if (session != null) {
-            try {
-                session.endAccess();
-            } catch (Throwable t) {
-                ExceptionUtils.handleThrowable(t);
-                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
-            }
-        }
-        session = null;
-        requestedSessionCookie = false;
-        requestedSessionId = null;
-        requestedSessionURL = false;
+        recycleSessionInfo();
 
         if (Globals.IS_SECURITY_ENABLED || Connector.RECYCLE_FACADES) {
             parameterMap = new ParameterMap<String, String[]>();
@@ -559,11 +548,24 @@ public void clearEncoders() {
     }
 
 
-    /**
-     * Clear cached encoders (to save memory for Comet requests).
-     */
-    public boolean read()
-        throws IOException {
+    protected void recycleSessionInfo() {
+        if (session != null) {
+            try {
+                session.endAccess();
+            } catch (Throwable t) {
+                ExceptionUtils.handleThrowable(t);
+                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
+            }
+        }
+        session = null;
+        requestedSessionCookie = false;
+        requestedSessionId = null;
+        requestedSessionURL = false;
+        requestedSessionSSL = false;
+    }
+
+
+    public boolean read() throws IOException {
         return (inputBuffer.realReadBytes(null, 0, 0) > 0);
     }

webapps/docs/changelog.xml+4 −0 modified

@@ -127,6 +127,10 @@
         <bug>58582</bug>: Combined realm should perform background processing
         on its sub-realms. Based upon a patch provided by Aidan. (kkolinko)
       </fix>
+      <fix>
+        Handle the unlikely case where different versions of a web application
+        are deployed with different session settings. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Cluster">

41fbee7ba154

Handle the unlikely case where different versions of a web application are deployed with different session settings

https://github.com/apache/tomcat80Mark ThomasNov 7, 2015via ghsa

commit

3 files changed · +27 −19

java/org/apache/catalina/connector/CoyoteAdapter.java+4 −2 modified

@@ -939,9 +939,11 @@ protected boolean postParseRequest(org.apache.coyote.Request req, Request reques
                                 // Reset mapping
                                 request.getMappingData().recycle();
                                 mapRequired = true;
-                                // Recycle cookies in case correct context is
-                                // configured with different settings
+                                // Recycle cookies and session info in case the
+                                // correct context is configured with different
+                                // settings
                                 req.getCookies().recycle();
+                                request.recycleSessionInfo();
                             }
                             break;
                         }

java/org/apache/catalina/connector/Request.java+19 −17 modified

@@ -491,18 +491,7 @@ public void recycle() {
         notes.clear();
         cookies = null;
 
-        if (session != null) {
-            try {
-                session.endAccess();
-            } catch (Throwable t) {
-                ExceptionUtils.handleThrowable(t);
-                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
-            }
-        }
-        session = null;
-        requestedSessionCookie = false;
-        requestedSessionId = null;
-        requestedSessionURL = false;
+        recycleSessionInfo();
 
         if (Globals.IS_SECURITY_ENABLED || Connector.RECYCLE_FACADES) {
             parameterMap = new ParameterMap<>();
@@ -545,11 +534,24 @@ public void clearEncoders() {
     }
 
 
-    /**
-     * Clear cached encoders (to save memory for Comet requests).
-     */
-    public boolean read()
-        throws IOException {
+    protected void recycleSessionInfo() {
+        if (session != null) {
+            try {
+                session.endAccess();
+            } catch (Throwable t) {
+                ExceptionUtils.handleThrowable(t);
+                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
+            }
+        }
+        session = null;
+        requestedSessionCookie = false;
+        requestedSessionId = null;
+        requestedSessionURL = false;
+        requestedSessionSSL = false;
+    }
+
+
+    public boolean read() throws IOException {
         return (inputBuffer.realReadBytes(null, 0, 0) > 0);
     }

webapps/docs/changelog.xml+4 −0 modified

@@ -157,6 +157,10 @@
         <bug>58582</bug>: Combined realm should perform background processing
         on its sub-realms. Based upon a patch provided by Aidan. (schultz)
       </fix>
+      <fix>
+        Handle the unlikely case where different versions of a web application
+        are deployed with different session settings. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

83679b99cd40

Handle the unlikely case where different versions of a web application are deployed with different session settings

https://github.com/apache/tomcatMark ThomasNov 7, 2015via ghsa

commit

2 files changed · +22 −14

java/org/apache/catalina/connector/CoyoteAdapter.java+4 −2 modified

@@ -757,9 +757,11 @@ protected boolean postParseRequest(org.apache.coyote.Request req, Request reques
                                 // Reset mapping
                                 request.getMappingData().recycle();
                                 mapRequired = true;
-                                // Recycle cookies in case correct context is
-                                // configured with different settings
+                                // Recycle cookies and session info in case the
+                                // correct context is configured with different
+                                // settings
                                 req.getCookies().recycle();
+                                request.recycleSessionInfo();
                             }
                             break;
                         }

java/org/apache/catalina/connector/Request.java+18 −12 modified

@@ -468,18 +468,7 @@ public void recycle() {
         notes.clear();
         cookies = null;
 
-        if (session != null) {
-            try {
-                session.endAccess();
-            } catch (Throwable t) {
-                ExceptionUtils.handleThrowable(t);
-                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
-            }
-        }
-        session = null;
-        requestedSessionCookie = false;
-        requestedSessionId = null;
-        requestedSessionURL = false;
+        recycleSessionInfo();
 
         if (Globals.IS_SECURITY_ENABLED || Connector.RECYCLE_FACADES) {
             parameterMap = new ParameterMap<>();
@@ -513,6 +502,23 @@ public void recycle() {
     }
 
 
+    protected void recycleSessionInfo() {
+        if (session != null) {
+            try {
+                session.endAccess();
+            } catch (Throwable t) {
+                ExceptionUtils.handleThrowable(t);
+                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
+            }
+        }
+        session = null;
+        requestedSessionCookie = false;
+        requestedSessionId = null;
+        requestedSessionURL = false;
+        requestedSessionSSL = false;
+    }
+
+
     // -------------------------------------------------------- Request Methods
 
     /**

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.029
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000