CVE-2020-13943

MEDIUM

Apache Tomcat 10.0.0-M1-10.0.0-M7,9.0.0.M1-9.0.37,8.5.0-8.5.57 - In...

Title source: llm
STIX 2.1

Description

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

References (7)

Core 7
Core References
Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4835
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuApr2021.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20201016-0007/

Scores

CVSS v3 4.3
EPSS 0.0957
EPSS Percentile 93.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

Status published
Products (50)
apache/tomcat 8.5.0
apache/tomcat 8.5.1
apache/tomcat 8.5.2
apache/tomcat 8.5.3
apache/tomcat 8.5.4
apache/tomcat 8.5.5
apache/tomcat 8.5.6
apache/tomcat 8.5.7
apache/tomcat 8.5.8
apache/tomcat 8.5.9
... and 40 more
Published Oct 12, 2020
Tracked Since Feb 18, 2026