PatchTheCVECVE-2016-5388: Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 sect
CVE-2016-5388 is a high-severity flaw (CVSS 8.1) affecting enterprise linux desktop, enterprise linux hpc node, enterprise linux hpc node eus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor
Why this priority
- High severity
- EPSS top 1%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 50.9% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2016-07-19 |
| Last modified | 2026-10-15 |
Last updated 2026-10-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2016-5388?
enterprise linux desktop: mitigate or apply the listed mitigation; enterprise linux hpc node: mitigate or apply the listed mitigation; enterprise linux hpc node eus: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2016-5388 being exploited?
CVE-2016-5388 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2016-5388 affect?
CVE-2016-5388 affects enterprise linux desktop, enterprise linux hpc node, enterprise linux hpc node eus. Severity is high (CVSS 8.1). Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment va
How urgent is CVE-2016-5388?
Priority 63/100. High severity; EPSS top 1%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Related CVEs
- CVE-2017-5436 HIGH 8.8 MITIGATE MITIGATE An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font
- CVE-2018-1061 MEDIUM 6.5 UPGRADE MITIGATE python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking
- CVE-2018-11784 MEDIUM 4.3 UPGRADE MITIGATE When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 re
- CVE-2016-6794 MEDIUM 5.3 UPGRADE MITIGATE When a SecurityManager is configured, a web application's ability to read system properties should be controll
- CVE-2016-10165 HIGH 7.1 UPGRADE MITIGATE The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive