CVE-2016-6816

CVE-2016-6816 describes a vulnerability in Apache Tomcat versions 6.0.0 to 9.0.0.M11 where the HTTP request line parser permitted invalid characters. This flaw, when combined with a proxy that interprets these characters differently, allows an attacker to inject data into the HTTP response. The vulnerability carries a CVSS score of 7.1 (High) due to its potential for web-cache poisoning, Cross-Site Scripting (XSS), and information disclosure, requiring user interaction (UI:R) for exploitation. While there is no evidence of active exploitation (KEV: No) and limited community discussion, an ExploitDB entry (EDB-41783) exists for information disclosure, indicating public exploit code availability.