CVE-2020-11996
CVE-2020-11996
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
CVSS 7.5 · High · EPSS 26.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache tomcat
- Versions
- 10.0.0-M1 to 10.0.0-M5: Affected
- 9.0.0.M1 to 9.0.35: Affected
- 8.5.0 to 8.5.55: Affected
No fix published
tomcat9 Debian:12
- Affected ranges
- ECOSYSTEM: < 9.0.36-1
Update to 9.0.36-1
tomcat9 Debian:13
- Affected ranges
- ECOSYSTEM: < 9.0.36-1
Update to 9.0.36-1
tomcat9 Debian:14
- Affected ranges
- ECOSYSTEM: < 9.0.36-1
Update to 9.0.36-1
tomcat8 Ubuntu:Pro:18.04:LTS
- Versions
- 8.5.21-1ubuntu1
- 8.5.29-1
- 8.5.30-1
- 8.5.30-1ubuntu1
- 8.5.30-1ubuntu1.2
- 8.5.30-1ubuntu1.3
- 8.5.30-1ubuntu1.4
- 8.5.39-1ubuntu1~18.04.1
- 8.5.39-1ubuntu1~18.04.2
- 8.5.39-1ubuntu1~18.04.3
- 8.5.39-1ubuntu1~18.04.3+esm1
- 8.5.39-1ubuntu1~18.04.3+esm2
- 8.5.39-1ubuntu1~18.04.3+esm3
- 8.5.39-1ubuntu1~18.04.3+esm4
- 8.5.39-1ubuntu1~18.04.3+esm5
- 8.5.39-1ubuntu1~18.04.3+esm6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:18.04:LTS
- Versions
- 9.0.16-3~18.04.1
- 9.0.16-3ubuntu0.18.04.1
- 9.0.16-3ubuntu0.18.04.2
- 9.0.16-3ubuntu0.18.04.2+esm1
- 9.0.16-3ubuntu0.18.04.2+esm2
- 9.0.16-3ubuntu0.18.04.2+esm3
- 9.0.16-3ubuntu0.18.04.2+esm4
- 9.0.16-3ubuntu0.18.04.2+esm5
- 9.0.16-3ubuntu0.18.04.2+esm6
- 9.0.16-3ubuntu0.18.04.2+esm7
- 9.0.16-3ubuntu0.18.04.2+esm8
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:20.04:LTS
- Versions
- 9.0.24-1
- 9.0.27-1
- 9.0.31-1
- Affected ranges
- ECOSYSTEM: < 9.0.31-1ubuntu0.1
Update to 9.0.31-1ubuntu0.1
Original sources
- https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rb4ee49ecc4c59620ffd5e66e84a17e526c2c3cfa95d0cd682d90d338%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rb820f1a2a02bf07414be12c653c2ab5321fd87b9bf6c5e635c53ff4b%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r74f5a8204efe574cbfcd95b2a16236fe95beb45c4d9fee3dc789dca9%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rea65d6ef2e45dd1c45faae83922042732866c7b88fa109b76c83db52%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rc80b96b4b96618b2b7461cb90664a428cfd6605eea9f74e51b792542%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r93ca628ef3a4530dfe5ac49fddc795f0920a4b2a408b57a30926a42b%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff1057115008100561%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r9ad911fe49450ed9405827af0e7a74104041081ff91864b1f2546bbd%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/ref0339792ac6dac1dba83c071a727ad72380899bde60f6aaad4031b9%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r6c29801370a36c1a5159679269777ad0c73276d3015b8bbefea66e5c%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html
- https://www.debian.org/security/2020/dsa-4727
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.html
- https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79%40%3Cusers.tomcat.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20200709-0002/
- https://usn.ubuntu.com/4596-1/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-11996