CVE-2018-1336

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

Affected products

Alt Linux, Apache Tomcat, Centos, Red Hat, Suse, Ubuntu

Apache Tomcat

≤ 7.0.86, 8.0.51, 8.5.30, 9.0.7, 8.0.0, 9.0.0

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

20.6% (97th percentile)

Weakness

CWE-835

NVD status

Modified

Published

2018-08-02

No exploit for CVE-2018-1336 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.