CVE-2017-6056: It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet...

Security readout for executives and security teams

CVE-2017-6056 is a denial-of-service issue in Apache Tomcat builds where a security fix was backported without a related bug fix. A crafted HTTPS request can drive Tomcat into an infinite loop, consuming service capacity. The business risk is outage, not data theft or remote code execution based on the supplied sources. Most likely exposure is internet-facing HTTPS Tomcat services running affected distribution packages, especially Debian Jessie packages before the named fixed versions. Ubuntu is named as affected, but the bundle does not provide exact Ubuntu package versions. Red Hat and NetApp references exist, but this bundle does not enumerate their exact affected products. Schedule remediation for exposed Tomcat services, especially legacy Debian or Ubuntu systems. The issue is old, but outage impact can still matter if unsupported packages remain in production. Escalate if Tomcat is public-facing or supports revenue, authentication, or customer portals. Mitigation focus: Upgrade Debian Jessie Tomcat packages to the fixed versions or later.; Check Ubuntu vendor guidance for the corresponding fixed Tomcat packages.; Review Red Hat and NetApp advisories if those products ship Tomcat components..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.