CVE-2020-11996
Uncontrolled Resource Consumption in Apache Tomcat
7.5 HighPublic exploitFix available
CVE-2020-11996 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published June 26, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 26.7%, the 98th percentile. Fixed in org.apache.tomcat:tomcat 10.0.0-M5.
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
26.7%Up 12.9 points since Apr 14, 2021
What each source reports
NVD Score used
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
CVE-2020-11996- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
CVE-2020-11996- Updated
- 2026-11-02
EUVDEUVD-2022-0828 No score
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
EUVD-2022-0828- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-53hp-jpwq-2jgq
Uncontrolled Resource Consumption in Apache Tomcat
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
GHSA-53hp-jpwq-2jgq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
CVE-2020-11996- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-11996
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
DEBIAN-CVE-2020-11996- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 15 moreShow less
OSVGHSA-53hp-jpwq-2jgq
Uncontrolled Resource Consumption in Apache Tomcat
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
GHSA-53hp-jpwq-2jgq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVRHSA-2020:5170
Red Hat Security Advisory: Red Hat JBoss Web Server 5.4 security release
- Record
RHSA-2020:5170- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-11996
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
UBUNTU-CVE-2020-11996- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-tomcat-2020-11996 No score
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0 to 10.0.0, 9.0.0 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
- Record
BIT-tomcat-2020-11996- Updated
- 2026-11-02
OSVCLSA-2025-1748282295 No score
Fix of 34 CVEs
- SECURITY UPDATE: Misc vulnerability fixes
- CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
- Update to 8.5.100
- debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
- debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
- CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
- Internal tests
- debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired
- Record
CLSA-2025-1748282295- Updated
- 2026-11-02
OSVMGASA-2020-0331 No score
Updated tomcat packages fix security vulnerability
A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive (CVE-2020-11996).
An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service (CVE-2020-13934).
The payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service (CVE-2020-13935).
- Record
MGASA-2020-0331- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1051-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Tomcat was updated to 9.0.36 See changelog at
- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:1051-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1063-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Tomcat was updated to 9.0.36 See changelog at
- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2020:1063-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11468-1 No score
tomcat-9.0.36-8.4 on GA media
These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11468-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13441-1 No score
tomcat10-10.1.14-1.1 on GA media
These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13441-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1841-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Tomcat was updated to 9.0.36 See changelog at
- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389).
- Record
SUSE-SU-2020:1841-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1962-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Tomcat was updated to 9.0.36 See changelog at
- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389).
- Record
SUSE-SU-2020:1962-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1963-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Tomcat was updated to 9.0.36 See changelog at
- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389).
- Record
SUSE-SU-2020:1963-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1983-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Tomcat was updated to 9.0.36 See changelog at
- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389).
- Record
SUSE-SU-2020:1983-1- Updated
- 2026-11-02
OSVUSN-4596-1 No score
tomcat9 vulnerabilities
It was discovered that Tomcat did not properly manage HTTP/2 streams. An attacker could possibly use this to cause Tomcat to consume resources, resulting in a denial of service. (CVE-2020-11996)
It was discovered that Tomcat did not properly release the HTTP/1.1 processor after the upgrade to HTTP/2. An attacker could possibly use this to generate an OutOfMemoryException, resulting in a denial of service. (CVE-2020-13934)
It was discovered that Tomcat did not properly validate the payload length in a WebSocket frame. An attacker could possibly use this to trigger an infinite loop, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat did not properly deserialize untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-9484)
- Record
USN-4596-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
10.0.0-M1 to 10.0.0-M4 | 10.0.0-M5 |
org.apache.tomcat:tomcatMaven |
9.0.0.M1 up to 9.0.35 | 9.0.35 |
org.apache.tomcat:tomcatMaven |
8.5.0 up to 8.5.55 | 8.5.55 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
10.0.0-M1 to 10.0.0-M4 | 10.0.0-M5 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
9.0.0.M1 up to 9.0.35 | 9.0.35 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
8.5.0 up to 8.5.55 | 8.5.55 |
tomcatBitnami |
8.5.0 up to 8.5.56, 9.0.0 up to 9.0.36 | 8.5.569.0.36 |
libtomcat8-embed-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
libtomcat8-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8TuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
Show 81 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat8-adminTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-commonTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-docsTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-examplesTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-userTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat9Debian:12 |
before 9.0.36-1 | 9.0.36-1 |
tomcat9Debian:13 |
before 9.0.36-1 | 9.0.36-1 |
tomcat9Debian:14 |
before 9.0.36-1 | 9.0.36-1 |
tomcat8Debian:9 |
before 8.5.54-0+deb9u2, plus listed versions 8.5.14-18.5.14-1+deb9u18.5.14-1+deb9u28.5.14-1+deb9u38.5.14-2 Show 33 moreShow less8.5.15-18.5.16-18.5.21-18.5.23-18.5.24-18.5.24-28.5.24-2~bpo9+18.5.28-18.5.28-1~bpo9+18.5.29-18.5.29-1~bpo9+18.5.30-18.5.31-18.5.32-18.5.32-28.5.33-18.5.33-1~bpo9+18.5.34-18.5.34-1~bpo9+18.5.35-18.5.35-28.5.35-2~bpo9+18.5.35-38.5.37-18.5.37-1~bpo9+18.5.37-28.5.38-18.5.38-1~bpo9+18.5.38-28.5.38-2~bpo9+18.5.39-18.5.50-0+deb9u18.5.54-0+deb9u1 |
8.5.54-0+deb9u2 |
tomcat9Debian:10 |
before 9.0.31-1~deb10u2, plus listed versions 9.0.16-49.0.16-59.0.22-19.0.24-19.0.27-19.0.31-1~bpo10+19.0.31-1~deb10u1 |
9.0.31-1~deb10u2 |
org.apache.tomcat:tomcatMaven |
10.0.0-M1 up to 10.0.0-M5, plus listed versions 10.0.0-M310.0.0-M4 |
10.0.0-M5 |
org.apache.tomcat:tomcatMaven |
9.0.0.M1 up to 9.0.35, plus listed versions 9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17 Show 39 moreShow less9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.49.0.59.0.69.0.79.0.8 |
9.0.35 |
org.apache.tomcat:tomcatMaven |
8.5.0 up to 8.5.55, plus listed versions 8.5.118.5.128.5.138.5.148.5.15 Show 37 moreShow less8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.68.5.88.5.9 |
8.5.55 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
10.0.0-M1 up to 10.0.0-M5, plus listed versions 10.0.0-M310.0.0-M4 |
10.0.0-M5 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
9.0.0.M1 up to 9.0.35, plus listed versions 9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17 Show 39 moreShow less9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.49.0.59.0.69.0.79.0.8 |
9.0.35 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
8.5.0 up to 8.5.55, plus listed versions 8.5.118.5.128.5.138.5.148.5.15 Show 37 moreShow less8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.68.5.88.5.9 |
8.5.55 |
tomcatMageia:7 |
before 9.0.37-1.2.mga7 | 9.0.37-1.2.mga7 |
jws5-jboss-loggingRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:3.4.1-1.Final_redhat_00001.1.el6jws | 0:3.4.1-1.Final_redhat_00001.1.el6jws |
jws5-mod_clusterRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:1.4.2-7.Final_redhat_00002.2.el6jws | 0:1.4.2-7.Final_redhat_00002.2.el6jws |
jws5-mod_cluster-tomcatRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:1.4.2-7.Final_redhat_00002.2.el6jws | 0:1.4.2-7.Final_redhat_00002.2.el6jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:1.2.25-2.redhat_2.el6jws | 0:1.2.25-2.redhat_2.el6jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:1.2.25-2.redhat_2.el6jws | 0:1.2.25-2.redhat_2.el6jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.4::el6 |
before 0:9.0.36-6.redhat_5.2.el6jws | 0:9.0.36-6.redhat_5.2.el6jws |
jws5-jboss-loggingRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:3.4.1-1.Final_redhat_00001.1.el7jws | 0:3.4.1-1.Final_redhat_00001.1.el7jws |
jws5-mod_clusterRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:1.4.2-7.Final_redhat_00002.2.el7jws | 0:1.4.2-7.Final_redhat_00002.2.el7jws |
jws5-mod_cluster-tomcatRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:1.4.2-7.Final_redhat_00002.2.el7jws | 0:1.4.2-7.Final_redhat_00002.2.el7jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:1.2.25-2.redhat_2.el7jws | 0:1.2.25-2.redhat_2.el7jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:1.2.25-2.redhat_2.el7jws | 0:1.2.25-2.redhat_2.el7jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-6.redhat_5.2.el7jws | 0:9.0.36-6.redhat_5.2.el7jws |
jws5-jboss-loggingRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:3.4.1-1.Final_redhat_00001.1.el8jws | 0:3.4.1-1.Final_redhat_00001.1.el8jws |
jws5-mod_clusterRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:1.4.2-7.Final_redhat_00002.2.el8jws | 0:1.4.2-7.Final_redhat_00002.2.el8jws |
jws5-mod_cluster-tomcatRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:1.4.2-7.Final_redhat_00002.2.el8jws | 0:1.4.2-7.Final_redhat_00002.2.el8jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:1.2.25-2.redhat_2.el8jws | 0:1.2.25-2.redhat_2.el8jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:1.2.25-2.redhat_2.el8jws | 0:1.2.25-2.redhat_2.el8jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-6.redhat_5.2.el8jws | 0:9.0.36-6.redhat_5.2.el8jws |
tomcatSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 9.0.36-3.60.1 | 9.0.36-3.60.1 |
tomcatSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 9.0.36-3.60.1 | 9.0.36-3.60.1 |
tomcatSUSE:Linux Enterprise Server 15-LTSS |
before 9.0.36-3.60.1 | 9.0.36-3.60.1 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 15 |
before 9.0.36-3.60.1 | 9.0.36-3.60.1 |
tomcatSUSE:Linux Enterprise Module for Web and Scripting 15 SP1 |
before 9.0.36-4.38.1 | 9.0.36-4.38.1 |
tomcatSUSE:OpenStack Cloud 9 |
before 9.0.36-3.42.2 | 9.0.36-3.42.2 |
tomcatSUSE:OpenStack Cloud Crowbar 9 |
before 9.0.36-3.42.2 | 9.0.36-3.42.2 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 9.0.36-3.42.2 | 9.0.36-3.42.2 |
tomcatSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 9.0.36-3.42.2 | 9.0.36-3.42.2 |
tomcatSUSE:Linux Enterprise Server 12 SP5 |
before 9.0.36-3.42.2 | 9.0.36-3.42.2 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 9.0.36-3.42.2 | 9.0.36-3.42.2 |
tomcatSUSE:Linux Enterprise Module for Web and Scripting 15 SP2 |
before 9.0.36-3.3.1 | 9.0.36-3.3.1 |
tomcat8Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2 Show 11 moreShow less8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6 |
None known |
tomcat9Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2 Show 6 moreShow less9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8 |
None known |
tomcat9Ubuntu:20.04:LTS |
before 9.0.31-1ubuntu0.1, plus listed versions 9.0.24-19.0.27-19.0.31-1 |
9.0.31-1ubuntu0.1 |
tomcatopenSUSE:Leap 15.1 |
before 9.0.36-lp151.3.24.1 | 9.0.36-lp151.3.24.1 |
tomcatopenSUSE:Leap 15.2 |
before 9.0.36-lp152.2.3.1 | 9.0.36-lp152.2.3.1 |
tomcatopenSUSE:Tumbleweed |
before 9.0.36-8.4 | 9.0.36-8.4 |
tomcat10openSUSE:Tumbleweed |
before 10.1.14-1.1 | 10.1.14-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996 | 2020-07-27 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E
Show 117 moreShow less
lists.debian.org/debian-lts-announce/2020/07/msg00010.html
debian.org/security/2020/dsa-4727
lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html
oracle.com/security-alerts/cpuoct2020.html
security.netapp.com/advisory/ntap-20200709-0002
usn.ubuntu.com/4596-1
nvd.nist.gov/vuln/detail/CVE-2020-11996
github.com/apache/tomcat/commit/9434a44d3449d620b1be70206819f8275b4a7509
tomcat.apache.org/security-9.html
errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html
security-tracker.debian.org/tracker/CVE-2020-11996
advisories.mageia.org/MGASA-2020-0331.html
bugs.mageia.org/show_bug.cgi?id=26862
access.redhat.com/errata/RHSA-2020:5170
bugzilla.redhat.com/show_bug.cgi?id=1851420
issues.redhat.com/browse/JWS-1050
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5170.json
cve.org/CVERecord?id=CVE-2020-11996
mail-archives.apache.org/mod_mbox/tomcat-announce/202006.mbox/%3Cfd56bc1d-1219-605b-99c7-946bf7bd8ad4%40apache.org%3E
suse.com/support/update/announcement/2020/suse-su-20201841-1
bugzilla.suse.com/1173389
ubuntu.com/security/CVE-2020-11996
openwall.com/lists/oss-security/2020/06/25/6