VYPR
← All advisories
High severity7.5NVD Advisory· Published Aug 10, 2017· Updated May 13, 2026

CVE-2016-8745

CVE-2016-8745

Description

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcat-utilMaven
>= 9.0.0.M1, < 9.0.0.M149.0.0.M14
org.apache.tomcat:tomcat-utilMaven
>= 8.5.0, < 8.5.98.5.9
org.apache.tomcat:tomcat-utilMaven
>= 8.0.0-RC1, < 8.0.418.0.41
org.apache.tomcat:tomcat-utilMaven
>= 7.0.0, < 7.0.757.0.75
org.apache.tomcat:tomcat-utilMaven
>= 6.0.16, < 6.0.506.0.50

Affected products

1
  • Apache Software Foundation/Apache Tomcatv5
    Range: 9.0.0.M1 to 9.0.0.M13

Patches

4
143bb466cf96

Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=60409

https://github.com/apache/tomcatMark ThomasJan 5, 2017via ghsa
commit
2 files changed · +10 −2
  • java/org/apache/tomcat/util/net/NioEndpoint.java+6 −2 modified
    @@ -1413,11 +1413,15 @@ public SendfileState processSendfile(SelectionKey sk, KeyAttachment attachment,
                 }
             }catch ( IOException x ) {
                 if ( log.isDebugEnabled() ) log.debug("Unable to complete sendfile request:", x);
-                cancelledKey(sk,SocketStatus.ERROR,false);
+                if (!calledByProcessor) {
+                    cancelledKey(sk,SocketStatus.ERROR,false);
+                }
                 return SendfileState.ERROR;
             }catch ( Throwable t ) {
                 log.error("",t);
-                cancelledKey(sk, SocketStatus.ERROR, false);
+                if (!calledByProcessor) {
+                    cancelledKey(sk, SocketStatus.ERROR, false);
+                }
                 return SendfileState.ERROR;
             }
         }
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -125,6 +125,10 @@
         when configured with an address of <code>0.0.0.0</code> or
         <code>::</code>. (markt)
       </fix>
+      <fix>
+        <bug>60409</bug>: When unable to complete sendfile request, ensure the
+        Processor will be added to the cache only once. (markt/violetagg)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">
3dd2fec73e0d

Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=60409

https://github.com/apache/tomcat80Mark ThomasJan 5, 2017via ghsa
commit
2 files changed · +10 −2
  • java/org/apache/tomcat/util/net/NioEndpoint.java+6 −2 modified
    @@ -1245,11 +1245,15 @@ public SendfileState processSendfile(SelectionKey sk, KeyAttachment attachment,
                 }
             }catch ( IOException x ) {
                 if ( log.isDebugEnabled() ) log.debug("Unable to complete sendfile request:", x);
-                cancelledKey(sk,SocketStatus.ERROR);
+                if (!calledByProcessor) {
+                    cancelledKey(sk,SocketStatus.ERROR);
+                }
                 return SendfileState.ERROR;
             }catch ( Throwable t ) {
                 log.error("",t);
-                cancelledKey(sk, SocketStatus.ERROR);
+                if (!calledByProcessor) {
+                    cancelledKey(sk, SocketStatus.ERROR);
+                }
                 return SendfileState.ERROR;
             }
         }
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -140,6 +140,10 @@
         when configured with an address of <code>0.0.0.0</code> or
         <code>::</code>. (markt)
       </fix>
+      <fix>
+        <bug>60409</bug>: When unable to complete sendfile request, ensure the
+        Processor will be added to the cache only once. (markt/violetagg)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">
16a57bc885e2

Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=60409

https://github.com/apache/tomcatVioleta Georgieva GeorgievaNov 29, 2016via ghsa
commit
3 files changed · +4 −7
  • java/org/apache/tomcat/util/net/NioEndpoint.java+0 −5 modified
    @@ -888,7 +888,6 @@ public SendfileState processSendfile(SelectionKey sk, NioSocketWrapper socketWra
                     // Setup the file channel
                     File f = new File(sd.fileName);
                     if (!f.exists()) {
-                        cancelledKey(sk);
                         return SendfileState.ERROR;
                     }
                     @SuppressWarnings("resource") // Closed when channel is closed
@@ -962,16 +961,12 @@ public SendfileState processSendfile(SelectionKey sk, NioSocketWrapper socketWra
                 if (log.isDebugEnabled()) log.debug("Unable to complete sendfile request:", x);
                 if (!calledByProcessor && sc != null) {
                     close(sc, sk);
-                } else {
-                    cancelledKey(sk);
                 }
                 return SendfileState.ERROR;
             } catch (Throwable t) {
                 log.error("", t);
                 if (!calledByProcessor && sc != null) {
                     close(sc, sk);
-                } else {
-                    cancelledKey(sk);
                 }
                 return SendfileState.ERROR;
             }
  • test/org/apache/catalina/connector/TestSendFile.java+0 −2 modified
    @@ -39,7 +39,6 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
 
-import org.junit.Ignore;
 import org.junit.Test;
 
 import org.apache.catalina.Context;
@@ -157,7 +156,6 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp)
     }
 
 
-    @Ignore
     @Test
     public void testBug60409() throws Exception {
         Tomcat tomcat = getTomcatInstance();
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -140,6 +140,10 @@
         removing closed streams from the priority tree to ensure that the tree
         does not grow too large. (markt)
       </fix>
+      <fix>
+        <bug>60409</bug>: When unable to complete sendfile request, ensure the
+        Processor will be added to the cache only once. (markt/violetagg)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Web applications">
cbc9b18a845d

Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=60409

https://github.com/apache/tomcatVioleta Georgieva GeorgievaNov 29, 2016via ghsa
commit
3 files changed · +4 −7
  • java/org/apache/tomcat/util/net/NioEndpoint.java+0 −5 modified
    @@ -888,7 +888,6 @@ public SendfileState processSendfile(SelectionKey sk, NioSocketWrapper socketWra
                     // Setup the file channel
                     File f = new File(sd.fileName);
                     if (!f.exists()) {
-                        cancelledKey(sk);
                         return SendfileState.ERROR;
                     }
                     @SuppressWarnings("resource") // Closed when channel is closed
@@ -962,16 +961,12 @@ public SendfileState processSendfile(SelectionKey sk, NioSocketWrapper socketWra
                 if (log.isDebugEnabled()) log.debug("Unable to complete sendfile request:", x);
                 if (!calledByProcessor && sc != null) {
                     close(sc, sk);
-                } else {
-                    cancelledKey(sk);
                 }
                 return SendfileState.ERROR;
             } catch (Throwable t) {
                 log.error("", t);
                 if (!calledByProcessor && sc != null) {
                     close(sc, sk);
-                } else {
-                    cancelledKey(sk);
                 }
                 return SendfileState.ERROR;
             }
  • test/org/apache/catalina/connector/TestSendFile.java+0 −2 modified
    @@ -39,7 +39,6 @@
 import static org.junit.Assert.assertEquals;
 
 import org.junit.Assert;
-import org.junit.Ignore;
 import org.junit.Test;
 
 import org.apache.catalina.Context;
@@ -157,7 +156,6 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp)
     }
 
 
-    @Ignore
     @Test
     public void testBug60409() throws Exception {
         Tomcat tomcat = getTomcatInstance();
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -167,6 +167,10 @@
         removing closed streams from the priority tree to ensure that the tree
         does not grow too large. (markt)
       </fix>
+      <fix>
+        <bug>60409</bug>: When unable to complete sendfile request, ensure the
+        Processor will be added to the cache only once. (markt/violetagg)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Web applications">

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

56

News mentions

0

No linked articles in our index yet.