CVE-2020-13935

high Apache
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
86.6%
Exploitation probability in 30 days
Top 0% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
None
Availability
High
Published: July 14, 2020 (2246 days ago)
Last Modified: August 25, 2026
Vendor: Apache
Source: NVD

Description

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

CWE

CWE-835

Affected Products

apache tomcatdebian debian linuxnetapp oncommand system manageropensuse leapcanonical ubuntu linuxmcafee epolicy orchestratororacle agile engineering data managementoracle agile product lifecycle managementoracle blockchain platformoracle commerce guided search

References

🔗 lists.opensuse.org 🔗 lists.opensuse.org 🔗 kc.mcafee.com 🔗 lists.apache.org 🔗 lists.apache.org