Log in Start free

Vulnerability · Published Oct 12, 2020 · Assigned by apache

CVE-2020-13943

Medium 4.3

In plain English

A medium-severity security flaw in Apache Tomcat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 52.6% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)52.6%top 1.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tomcat99.0.38-1DEBIAN-CVE-2020-13943
Debian:13tomcat99.0.38-1DEBIAN-CVE-2020-13943
Debian:14tomcat99.0.38-1DEBIAN-CVE-2020-13943
Mavenorg.apache.tomcat:tomcat-coyote10.0.0-M8GHSA-f268-65qc-98vg
Mavenorg.apache.tomcat:tomcat-coyote9.0.38GHSA-f268-65qc-98vg
Mavenorg.apache.tomcat:tomcat-coyote8.5.58GHSA-f268-65qc-98vg

Affected products (as reported)

VendorProductVersions
n/a Apache Tomcat Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57

References