Fixed in Apache Tomcat JK Connector 1.2.42

Moderate: Buffer Overflow CVE-2016-6808

The IIS/ISAPI specific code implements special handling when a virtual host is present. The virtual host name and the URI are concatenated to create a virtual host mapping rule. The length checks prior to writing to the target buffer for this rule did not take account of the length of the virtual host name, creating the potential for a buffer overflow.

It is not known if this overflow is exploitable.

This was fixed in revision 1762057.

Affects: JK 1.2.0-1.2.41