{"id":"CVE-2020-13943","published":"2020-10-12T13:46:47Z","modified":"2026-10-08T21:13:52Z","title":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded…","vendor":null,"product":null,"tier":"tail","description":{"text":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.52639,"percentile":0.98968,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://www.debian.org/security/2021/dsa-4835","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0007/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":19.8,"factors":[{"name":"EPSS percentile","points":19.79}]},"affectedVersions":[{"vendor":"n/a","product":"Apache Tomcat","versions":["Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M8",">=9.0.0-M1, <9.0.38",">=8.5.0, <8.5.58"],"patched":["10.0.0-M8","9.0.38","8.5.58"],"from":["GHSA-f268-65qc-98vg"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0967","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-52434","published":"2025-07-10","fixed":"9.0.107","kev":false},{"cve":"CVE-2020-17527","published":"2020-12-03","fixed":"10.0.0-M10","kev":false,"link":{"from":"CVE-2020-13943","to":"CVE-2020-17527","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.38","toFixed":"9.0.40","daysApart":52},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"8.5.58","toFixed":"8.5.60","daysApart":52}]}},{"cve":"CVE-2020-13934","published":"2020-07-14","fixed":"10.0.0-M6","kev":false,"link":{"from":"CVE-2020-13934","to":"CVE-2020-13943","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.36","toFixed":"9.0.38","daysApart":90},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"10.0.0-M6","toFixed":"10.0.0-M8","daysApart":90}]}},{"cve":"CVE-2020-13943","published":"2020-10-12","fixed":"10.0.0-M8","kev":false},{"cve":"CVE-2021-25122","published":"2021-03-01","fixed":"10.0.2","kev":false,"link":{"from":"CVE-2020-13943","to":"CVE-2021-25122","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"10.0.0-M8","toFixed":"10.0.2","daysApart":140}]}},{"cve":"CVE-2022-42252","published":"2022-11-01","fixed":"10.1.1","kev":false},{"cve":"CVE-2023-46589","published":"2023-11-28","fixed":"11.0.0-M11","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-coyote"}}