{"id":"CVE-2020-13934","published":"2020-07-14T14:59:11Z","modified":"2026-10-08T21:13:57Z","title":"An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"Apache Tomcat","versions":["Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56"]}],"description":{"text":"An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in Apache Tomcat's HTTP/2 handling over h2c (cleartext) direct connections, where the HTTP/1.1 processor is not released after upgrading to HTTP/2, affecting versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, and 8.5.1 to 8.5.56. An attacker able to send a sufficient number of such h2c direct connection requests can exhaust memory and trigger an OutOfMemoryException, causing a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:56Z"},"cvss":null,"epss":{"score":0.64124,"percentile":0.99225,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2020/dsa-4727","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0003/","tags":["x_refsource_CONFIRM"]},{"url":"https://usn.ubuntu.com/4596-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M6",">=9.0.0.M5, <9.0.36",">=8.5.1, <8.5.56"],"patched":["10.0.0-M6","9.0.36","8.5.56"],"from":["GHSA-vf77-8h7g-gghp"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M6",">=9.0.0.M5, <9.0.36",">=8.5.1, <8.5.56"],"patched":["10.0.0-M6","9.0.36","8.5.56"],"from":["GHSA-vf77-8h7g-gghp"],"provenance":"source"}],"advisories":[{"id":"GHSA-vf77-8h7g-gghp","url":"https://github.com/advisories/GHSA-vf77-8h7g-gghp","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M6"],"patched":["10.0.0-M6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vf77-8h7g-gghp","url":"https://github.com/advisories/GHSA-vf77-8h7g-gghp","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=9.0.0.M5, <9.0.36"],"patched":["9.0.36"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vf77-8h7g-gghp","url":"https://github.com/advisories/GHSA-vf77-8h7g-gghp","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=8.5.1, <8.5.56"],"patched":["8.5.56"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vf77-8h7g-gghp","url":"https://github.com/advisories/GHSA-vf77-8h7g-gghp","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M6"],"patched":["10.0.0-M6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vf77-8h7g-gghp","url":"https://github.com/advisories/GHSA-vf77-8h7g-gghp","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=9.0.0.M5, <9.0.36"],"patched":["9.0.36"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vf77-8h7g-gghp","url":"https://github.com/advisories/GHSA-vf77-8h7g-gghp","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=8.5.1, <8.5.56"],"patched":["8.5.56"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1201","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1201","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-07-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-13934","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9922"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2019-17569","published":"2020-02-24","fixed":"9.0.31","kev":false},{"cve":"CVE-2020-1935","published":"2020-02-24","fixed":"9.0.31","kev":false},{"cve":"CVE-2020-11996","published":"2020-06-26","fixed":"10.0.0-M5","kev":false,"link":{"from":"CVE-2020-11996","to":"CVE-2020-13934","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.35","toFixed":"9.0.36","daysApart":18},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.55","toFixed":"8.5.56","daysApart":18},{"kind":"similar","provenance":"machine","score":0.24,"basis":"same package + description similarity"}]}},{"cve":"CVE-2020-13934","published":"2020-07-14","fixed":"10.0.0-M6","kev":false},{"cve":"CVE-2020-13935","published":"2020-07-14","fixed":"10.0.0-M7","kev":false,"link":{"from":"CVE-2020-13934","to":"CVE-2020-13935","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.36","toFixed":"9.0.37","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.56","toFixed":"8.5.57","daysApart":0}]}},{"cve":"CVE-2021-41079","published":"2021-09-16","fixed":"10.0.4","kev":false},{"cve":"CVE-2021-30639","published":"2021-07-12","fixed":"10.0.5","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}