CVE-2016-5388: Apache Tomcat CGI Servlet HTTP_PROXY header injection (httpoxy)

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.1 with high EPSS and no authentication or user interaction required, though exploitation depends on the CGI Servlet being enabled and the application making outbound HTTP calls.

What it is

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, passes the client-supplied Proxy header into the HTTP_PROXY environment variable as required by RFC 3875 section 4.1.18. This lets a remote attacker control the proxy setting used by CGI applications, redirecting their outbound HTTP traffic. The record notes the vendor treats this as a planned mitigation rather than a standalone vulnerability.

Impact

An attacker can redirect outbound HTTP requests made by CGI applications to an arbitrary proxy server they control, enabling interception or manipulation of that traffic. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable remotely over the network via a crafted Proxy header in an HTTP request; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N). It only applies where the CGI Servlet is enabled and the CGI application makes outbound HTTP calls.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.50896 probability, 98.873 percentile), and references are advisory, patch and vendor-response pages rather than exploit code.

What to do

• Upgrade Tomcat to a release containing the vendor's planned httpoxy mitigation, or apply the relevant Red Hat, Oracle or HPE errata for bundled Tomcat.
• If the CGI Servlet is not needed, disable it (remove or comment the CGI servlet and its servlet-mapping in web.xml).
• Where CGI must remain, strip or reject client-supplied Proxy headers at the reverse proxy or web server before they reach Tomcat.
• Set HTTP_PROXY explicitly in the CGI execution environment so client input cannot override it.
• Review CGI applications that make outbound HTTP calls and route them through a trusted, explicitly configured proxy.

Detection

• Inspect HTTP request logs for client-supplied Proxy headers reaching Tomcat, especially on paths served by the CGI Servlet.
• Monitor CGI application outbound connections for traffic to unexpected or attacker-controlled proxy destinations.
• Audit Tomcat web.xml and server configuration for enabled CGI Servlet deployments.
• Correlate outbound proxy anomalies with requests containing Proxy headers to identify attempted redirection.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.