CVE-2007-6286: Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does n...

Security readout for executives and security teams

This is an old Apache Tomcat issue affecting specific 5.5 and 6.0 versions when the native APR connector handles SSL. An empty request to the SSL port could cause Tomcat to process a duplicate copy of a recent request. The business concern is unintended replay of prior actions, not system takeover based on the provided sources. Exposure is most likely in legacy Tomcat deployments from the affected ranges with SSL served through the native APR connector. Modern supported Tomcat versions or deployments not using the APR SSL connector are less likely to be exposed, based on the provided description. Treat this as a targeted legacy-platform risk. It is not KEV-listed and has no cited active exploitation, but exposed affected Tomcat systems could replay recent requests and should be removed from the vulnerable range during legacy remediation. Mitigation focus: Inventory Tomcat versions and identify any 5.5.11-5.5.25 or 6.0.0-6.0.15 instances.; Check whether affected instances use the native APR connector for SSL.; Upgrade affected Tomcat deployments beyond the vulnerable ranges using Apache guidance..

Prepared

Jun 28, 2026, 19:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.