CVE-2016-5388

Exploitation likely. EPSS gives it a 51% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.08.1High EPSS percentile99th51% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-07-19Updated 2026-05-06Sources: CVE.org, NVD, GitHub

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether Apache Tomcat is running and whether its CGI Servlet has been explicitly enabled.
If CGI is enabled, upgrade Apache Tomcat 7 to 7.0.72 or later, or Apache Tomcat 8 to 8.5.5 or later.
If an upgrade must wait, disable the CGI Servlet unless your application specifically requires it.
Review outbound web-request settings and credentials used by affected applications after the change.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

In plain language

Written by AI from the record

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4 need attention only if you have enabled its CGI feature, because a visitor can redirect the server’s outgoing web requests.

Unauthenticated HTTPoxy-style proxy injection in Apache Tomcat’s enabled CGI Servlet allows a crafted Proxy header to set HTTP_PROXY and redirect outbound HTTP connections.

If you're affected

Intercepted outbound web requests
Stolen service credentials
Altered supplier connections
Application service disruption

What is it

This issue lets an outsider slip routing instructions into a web request so the server may send its own outgoing web traffic through a proxy chosen by the outsider. It is like someone changing the forwarding address on your business mail: messages intended for a trusted destination may first pass through someone else’s hands.

Who is affected

This matters to you if you run Apache Tomcat and have explicitly enabled its CGI Servlet. It is only a risk when that feature is enabled and reachable by an attacker.

How urgent is it

There is no recorded confirmed exploitation or public exploit code, but the predicted likelihood of attack is high and rising. Treat this as an amber priority: check the CGI setting promptly and upgrade or disable the feature if it is enabled.

What to do — in detail

Confirm exposure by identifying deployed Apache Tomcat versions and inspecting the configuration for an enabled CGI Servlet. Affected Tomcat 7 deployments should move to 7.0.72 or later; affected Tomcat 8 deployments should move to 8.5.5 or later. Test the upgrade with applications that depend on CGI, as disabling or changing CGI-related configuration may affect those applications. If patching is delayed, disable the CGI Servlet where it is not required and restrict external access to any application that requires it. This CVE is not in CISA KEV, so no CISA remediation due date applies. After remediation, review application outbound HTTP behavior and investigate unexpected proxy configuration or outbound connections.

Technical context

CVSS 3.0 severity is 8.1 (High): AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is CWE-284 and is triggered remotely through a crafted HTTP Proxy header when the Tomcat CGI Servlet is enabled; it can influence the HTTP_PROXY environment variable used by CGI applications. EPSS is 50.9% (99th percentile) and rising. It is not listed in CISA KEV, and no public exploit code is on record.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

51% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

23 events over 3718 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-29EPSS band changehigh → moderate

Affected products

redhatcommercial · USaka red hat
Mavenpackage-ecosystem
- org.apache.tomcat:tomcat-catalinaOSS Libraries
hpcommercial · USaka hewlett packard, hpe
- system management homepageWeb AppOn-premEnterprise Software / itsm-monitoring
oraclecommercial · USaka oracle corp.
- linuxOn-premDatabases / cache-message-queue
apacheoss-project · USaka apache http server, apache httpd
- tomcatWeb AppOn-premNetworking Infrastructure / load-balancer-proxy

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-284No name in the record

Sources

References in the record

And 43 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Redhat, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account