CVE-2018-1336

—

CVSS 3.1

7.5 high

EPSS

21%p97

Published

Aug 2, 2018 (Aug 2, 2018)

Modified

Jun 17, 2026

Description

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

Vendors: apache redhat canonical debian
Products: tomcat, jboss enterprise application platform, ubuntu linux, debian linux, jboss enterprise web server, enterprise linux desktop, enterprise linux server, enterprise linux workstation
Weakness: CWE-835
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (20.6%)

In the news2 stories

Apache Software Foundation fixes important flaws in Apache Tomcat

Security AffairsJul 25, 06:35 UTC · Jul 25, 2018Exploit / PoC in the wildCVE-2018-8037 CVE-2018-1336 CVE-2018-80341

Apache Tomcat Patches Important Security Vulnerabilities

The Hacker NewsJul 24, 11:36 UTC · Jul 24, 2018Vulnerability in the wildCVE-2018-8037 CVE-2018-1336 CVE-2018-8034