CVE-2016-5388

Published: Jul 19, 2016Updated: May 6, 2026 Sources: CVE List NVD GHSACWE-284

8.1HIGH

NVD MITRE

Description

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

In plain language

AI Worth attention

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4 need attention only if you have enabled its CGI feature, because a visitor can redirect the server’s outgoing web requests.

Executive summary

Unauthenticated HTTPoxy-style proxy injection in Apache Tomcat’s enabled CGI Servlet allows a crafted Proxy header to set HTTP_PROXY and redirect outbound HTTP connections.

If affected, business impact

Intercepted outbound web requestsStolen service credentialsAltered supplier connectionsApplication service disruption

What to do now

Check whether Apache Tomcat is running and whether its CGI Servlet has been explicitly enabled.
If CGI is enabled, upgrade Apache Tomcat 7 to 7.0.72 or later, or Apache Tomcat 8 to 8.5.5 or later.
If an upgrade must wait, disable the CGI Servlet unless your application specifically requires it.
Review outbound web-request settings and credentials used by affected applications after the change.

Patch / advisory Usually a quick update

What is it

This issue lets an outsider slip routing instructions into a web request so the server may send its own outgoing web traffic through a proxy chosen by the outsider. It is like someone changing the forwarding address on your business mail: messages intended for a trusted destination may first pass through someone else’s hands.

Who is affected

This matters to you if you run Apache Tomcat and have explicitly enabled its CGI Servlet. It is only a risk when that feature is enabled and reachable by an attacker.

How urgent is it

There is no recorded confirmed exploitation or public exploit code, but the predicted likelihood of attack is high and rising. Treat this as an amber priority: check the CGI setting promptly and upgrade or disable the feature if it is enabled.

What to do — in detail

Confirm exposure by identifying deployed Apache Tomcat versions and inspecting the configuration for an enabled CGI Servlet. Affected Tomcat 7 deployments should move to 7.0.72 or later; affected Tomcat 8 deployments should move to 8.5.5 or later. Test the upgrade with applications that depend on CGI, as disabling or changing CGI-related configuration may affect those applications. If patching is delayed, disable the CGI Servlet where it is not required and restrict external access to any application that requires it. This CVE is not in CISA KEV, so no CISA remediation due date applies. After remediation, review application outbound HTTP behavior and investigate unexpected proxy configuration or outbound connections.

Technical context

CVSS 3.0 severity is 8.1 (High): AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is CWE-284 and is triggered remotely through a crafted HTTP Proxy header when the Tomcat CGI Servlet is enabled; it can influence the HTTP_PROXY environment variable used by CGI applications. EPSS is 50.9% (99th percentile) and rising. It is not listed in CISA KEV, and no public exploit code is on record.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.