{"id":"CVE-2016-5388","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-5388","generatedAt":"2026-11-05T05:24:18.632Z","title":"Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which…","description":"Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388\"; in other words, this is not a CVE ID for a vulnerability.","published":"2016-07-19T02:00:21.000Z","lastModified":"2026-10-15T16:17:26.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.0","score":8.1,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-284"],"affected":["redhat/enterprise linux desktop","redhat/enterprise linux hpc node","redhat/enterprise linux hpc node eus","redhat/enterprise linux server","redhat/enterprise linux server aus","redhat/enterprise linux server eus","redhat/enterprise linux server tus","redhat/enterprise linux workstation","hp/system management homepage","oracle/linux","apache/tomcat"],"epss":{"score":0.50896,"percentile":0.9893,"date":"2026-11-04","history":[{"date":"2026-09-21","score":0.40702,"percentile":0.98633},{"date":"2026-09-22","score":0.50896,"percentile":0.98876}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 50.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-22T00:00:00.000Z","detail":{"to":0.50896,"from":0.40702,"percentile":0.98876},"summary":"EPSS moved from 40.7% to 50.9% probability of exploitation in the next thirty days."}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1624.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2045.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2046.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.kb.cert.org/vuls/id/797896","tags":["Third Party Advisory","US Government Resource"],"source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/91818","tags":["Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1036331","tags":["Third Party Advisory","VDB Entry","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2016:1635","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2016:1636","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://httpoxy.org/","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","source":"secalert@redhat.com"},{"url":"https://tomcat.apache.org/tomcat-7.0-doc/changelog.html","tags":["Release Notes","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.apache.org/security/asf-httpoxy-response.txt","tags":["Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1624.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2045.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2046.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.kb.cert.org/vuls/id/797896","tags":["Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/91818","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1036331","tags":["Third Party Advisory","VDB Entry","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2016:1635","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2016:1636","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://httpoxy.org/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://tomcat.apache.org/tomcat-7.0-doc/changelog.html","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.apache.org/security/asf-httpoxy-response.txt","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-5388","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}