CVE-2017-7674: The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to...

Security readout for executives and security teams

Apache Tomcat’s built-in CORS Filter could return CORS-dependent responses without telling caches that the Origin header matters. In certain deployments, a cache could store a response prepared for one origin and serve it to another, causing cache poisoning. Exposure depends on affected Tomcat versions, CORS Filter use, and cache behavior. Most likely exposed assets are web applications running affected Apache Tomcat versions with the CORS Filter enabled and responses cached by browsers, proxies, CDNs, or server-side caches. Systems not using Tomcat’s CORS Filter are less likely exposed based on the provided evidence. Treat as a moderate-priority web platform hygiene issue. It is not listed as actively exploited in the provided sources, but affected internet-facing Tomcat applications using CORS and caching should be patched promptly to prevent incorrect cached responses crossing trust boundaries. Mitigation focus: Inventory Tomcat versions and identify instances within the affected version ranges.; Apply Apache Tomcat or operating-system vendor security updates for affected deployments.; Prioritize internet-facing applications using Tomcat’s CORS Filter and shared caching layers..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.