CVE-2020-13934

high Apache
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
64.1%
Exploitation probability in 30 days
Top 1% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
None
Availability
High
Published: July 14, 2020 (2246 days ago)
Last Modified: August 25, 2026
Vendor: Apache
Source: NVD

Description

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

CWE

CWE-401

Affected Products

apache tomcatdebian debian linuxnetapp oncommand system manageropensuse leapcanonical ubuntu linuxoracle agile engineering data managementoracle agile product lifecycle managementoracle communications instant messaging serveroracle fmw platformoracle instantis enterprisetrack

References

🔗 lists.opensuse.org 🔗 lists.opensuse.org 🔗 lists.apache.org 🔗 lists.apache.org 🔗 lists.debian.org