Patchfirst
Patchfirst
CVE-2020-13934 EPSS 64.1%

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not…

Summary

The flaw is in Apache Tomcat's HTTP/2 handling over h2c (cleartext) direct connections, where the HTTP/1.1 processor is not released after upgrading to HTTP/2, affecting versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, and 8.5.1 to 8.5.56. An attacker able to send a sufficient number of such h2c direct connection requests can exhaust memory and trigger an OutOfMemoryException, causing a denial of service.

Official description · CVE.org

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Breakdown
19.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 14 Jul 2020. No public exploit code or confirmed exploitation is recorded.

7 fixes in tomcat over 19 months. The latest fix listed for tomcat is 10.0.5.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 9.0.31CVE-2019-1756924 Feb 2020
  2. 9.0.31CVE-2020-193524 Feb 2020
  3. 10.0.0-M5CVE-2020-1199626 Jun 2020
  4. 10.0.0-M6CVE-2020-1393414 Jul 2020
  5. 10.0.0-M7CVE-2020-1393514 Jul 2020
  6. 10.0.4CVE-2021-4107916 Sep 2021
  7. 10.0.5CVE-2021-3063912 Jul 2021Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-vf77-8h7g-gghp

Upgrade to 9.0.109

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2019-0221, CVE-2020-13935, +4).

Also affected, despite being newer: 10.0.0-M1 up to 10.0.0-M6.

Set the version to 9.0.109 or later in your pom.xml or build.gradle.

First fixed in 9.0.36 for CVE-2020-13934.

Affected versions, by release line

If you runUpgrade to
10.0.0-M1 up to 10.0.0-M610.0.22first fix for this CVE: 10.0.0-M6
9.0.0.M5 up to 9.0.369.0.109first fix for this CVE: 9.0.36
8.5.1 up to 8.5.56

Still affected on this line by CVE-2025-55752 (no fix published).

8.5.82first fix for this CVE: 8.5.56

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • Mavenorg.apache.tomcat:tomcat-coyote
    Affected: 10.0.0-M1 up to 10.0.0-M6; 9.0.0.M5 up to 9.0.36; 8.5.1 up to 8.5.56Upgrade to 9.0.104 (older lines: 10.0.0-M6, 8.5.94)
    GHSA-vf77-8h7g-gghp

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

13 links, grouped by NVD tag

x_refsource_MISC 6

lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3Eoracle.com/security-alerts/cpuoct2020.htmloracle.com/security-alerts/cpujan2021.htmloracle.com/security-alerts/cpuApr2021.htmloracle.com//security-alerts/cpujul2021.htmloracle.com/security-alerts/cpujan2022.html

vendor-advisory 4

debian.org/security/2020/dsa-4727lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.htmllists.opensuse.org/opensuse-security-announce/2020-07/msg00088.htmlusn.ubuntu.com/4596-1/

mailing-list 2

lists.debian.org/debian-lts-announce/2020/07/msg00017.htmllists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E

x_refsource_CONFIRM 1

security.netapp.com/advisory/ntap-20200724-0003/
↑ ↓ chooseEnter openEsc close