The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the…

Description

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Scores

EPSS (exploitation in 30 days)

16.6% · top 3.0% of all CVEs (3 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• Security Constrainy Bypass
• CWE-755 (opens in a new tab)All about CWE-755 and its CVEs

Affected products

• Apache Software Foundation · Apache Tomcat

  • affected 9.0.0.M1 to 9.0.0.M20
  • affected 8.5.0 to 8.5.14
  • affected 8.0.0.RC1 to 8.0.43
  • affected 7.0.0 to 7.0.77

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.tomcat:tomcatGHSA-jmvv-524f-hj5j (opens in a new tab)

References (38)

• DSA-3891 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• https://security.netapp.com/advisory/ntap-20171019-0002/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• 98888 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2017:3080 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2017:1801 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2017:2635 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2017:2638 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2017:2494 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• [tomcat-users] 20170606 [SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2017:2636 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2017:1809 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2017:2637 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 1038641 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• DSA-3892 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• RHSA-2017:2633 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2017:1802 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2017:2493 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html (opens in a new tab)x_refsource_MISCx_transferred
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html (opens in a new tab)x_refsource_MISCx_transferred
• [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-jmvv-524f-hj5j (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-5664](https://trackcve.app/badge/CVE-2017-5664.svg)](https://trackcve.app/cve/CVE-2017-5664)

Record last updated 15 Oct 2026, 15:58 UTC.