{"id":"CVE-2020-13935","published":"2020-07-14T15:00:21Z","modified":"2026-10-08T21:03:33Z","title":"The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"Apache Tomcat","versions":["Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, 7.0.27 to 7.0.104"]}],"description":{"text":"The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.","provenance":"source","from":"CVE.org"},"summary":{"text":"The payload length check for WebSocket frames in Apache Tomcat versions 10.0.0-M1 through 10.0.0-M6, 9.0.0.M1 through 9.0.36, 8.5.0 through 8.5.56, and 7.0.27 through 7.0.104 is not validated correctly, allowing invalid lengths to trigger an infinite loop. An attacker able to send WebSocket frames to the affected server can cause a denial of service by repeatedly sending frames with invalid payload lengths.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:46Z"},"cvss":null,"epss":{"score":0.86608,"percentile":0.99738,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"Midwest Malware","url":"https://otx.alienvault.com/pulse/6a8e6c8dc6d3df83aac08378","created":"2026-08-26"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"ACTUALIZACION | ||Oracle Critical Patch Update Advisory - April 2025","url":"https://otx.alienvault.com/pulse/6807e1c45dd52410facbed8f","created":"2025-04-22"},{"name":"Oracle Critical Patch Update Advisory - April 2022","url":"https://otx.alienvault.com/pulse/626040216e00cd388b1b9180","created":"2022-04-20"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2020/dsa-4727","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://usn.ubuntu.com/4448-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0003/","tags":["x_refsource_CONFIRM"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10332","tags":["x_refsource_CONFIRM"]},{"url":"https://usn.ubuntu.com/4596-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M7",">=9.0.0.M1, <9.0.37",">=8.5.0, <8.5.57",">=7.0.27, <7.0.105"],"patched":["10.0.0-M7","9.0.37","8.5.57","7.0.105"],"from":["GHSA-m7jv-hq7h-mq7c"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","vulnerableRanges":[">=7.0.27, <7.0.105",">=8.5.0, <8.5.57",">=9.0.0.M1, <9.0.37",">=10.0.0-M1, <10.0.0-M7"],"patched":["7.0.105","8.5.57","9.0.37","10.0.0-M7"],"from":["GHSA-m7jv-hq7h-mq7c"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-websocket","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M7",">=9.0.0.M1, <9.0.37",">=8.5.0, <8.5.57",">=7.0.27, <7.0.105"],"patched":["10.0.0-M7","9.0.37","8.5.57","7.0.105"],"from":["GHSA-m7jv-hq7h-mq7c"],"provenance":"source"}],"advisories":[{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M7"],"patched":["10.0.0-M7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=9.0.0.M1, <9.0.37"],"patched":["9.0.37"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=8.5.0, <8.5.57"],"patched":["8.5.57"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=7.0.27, <7.0.105"],"patched":["7.0.105"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","vulnerableRanges":[">=7.0.27, <7.0.105"],"patched":["7.0.105"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","vulnerableRanges":[">=8.5.0, <8.5.57"],"patched":["8.5.57"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","vulnerableRanges":[">=9.0.0.M1, <9.0.37"],"patched":["9.0.37"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M7"],"patched":["10.0.0-M7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-websocket","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M7"],"patched":["10.0.0-M7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-websocket","vulnerableRanges":[">=9.0.0.M1, <9.0.37"],"patched":["9.0.37"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-websocket","vulnerableRanges":[">=8.5.0, <8.5.57"],"patched":["8.5.57"],"provenance":"source","from":"GHSA"},{"id":"GHSA-m7jv-hq7h-mq7c","url":"https://github.com/advisories/GHSA-m7jv-hq7h-mq7c","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-websocket","vulnerableRanges":[">=7.0.27, <7.0.105"],"patched":["7.0.105"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1098","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1098","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2020-11-02","earliestUrl":"https://github.com/RedTeamPentesting/CVE-2020-13935","repos":[{"name":"RedTeamPentesting/CVE-2020-13935","url":"https://github.com/RedTeamPentesting/CVE-2020-13935","stars":167,"created":"2020-11-02"}]},"first":{"date":"2020-11-02","source":"PoC-in-GitHub","url":"https://github.com/RedTeamPentesting/CVE-2020-13935"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-07-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-13935","provenance":"source"},{"date":"2020-11-02","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/RedTeamPentesting/CVE-2020-13935","provenance":"source"}],"speed":{"daysToPublicExploit":111,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":26.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9974"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-org-apache-tomcat-tomcat-cve-2020-13935","children":[{"from":"CVE-2020-13935","to":"CVE-2020-14384","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame.","from":"CVE.org","in":"CVE-2020-14384"}]}],"packageHistory":[{"cve":"CVE-2019-17569","published":"2020-02-24","fixed":"9.0.31","kev":false,"link":{"from":"CVE-2019-17569","to":"CVE-2020-13935","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.100","toFixed":"7.0.105","daysApart":141}]}},{"cve":"CVE-2020-1935","published":"2020-02-24","fixed":"9.0.31","kev":false},{"cve":"CVE-2020-11996","published":"2020-06-26","fixed":"10.0.0-M5","kev":false},{"cve":"CVE-2020-13934","published":"2020-07-14","fixed":"10.0.0-M6","kev":false,"link":{"from":"CVE-2020-13934","to":"CVE-2020-13935","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.36","toFixed":"9.0.37","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.56","toFixed":"8.5.57","daysApart":0}]}},{"cve":"CVE-2020-13935","published":"2020-07-14","fixed":"10.0.0-M7","kev":false},{"cve":"CVE-2021-41079","published":"2021-09-16","fixed":"10.0.4","kev":false,"link":{"from":"CVE-2020-13935","to":"CVE-2021-41079","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.37","toFixed":"9.0.44","daysApart":429},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.57","toFixed":"8.5.64","daysApart":429}]}},{"cve":"CVE-2021-30639","published":"2021-07-12","fixed":"10.0.5","kev":false},{"cve":"CVE-2021-30640","published":"2021-07-12","fixed":"10.0.5","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}