CVE-2020-13943
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
- Record
CVE-2020-13943- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
- Record
CVE-2020-13943- Updated
- 2026-11-02
EUVDEUVD-2022-0967 No score
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
- Record
EUVD-2022-0967- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f268-65qc-98vg
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
- Record
GHSA-f268-65qc-98vg- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
- Record
CVE-2020-13943- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-13943
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
- Record
DEBIAN-CVE-2020-13943- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 14 moreShow less
OSVGHSA-f268-65qc-98vg
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
- Record
GHSA-f268-65qc-98vg- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVRHSA-2021:0494
Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update
- Record
RHSA-2021:0494- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-tomcat-2020-13943 No score
If an HTTP/2 client connecting to Apache Tomcat 9.0.0 through 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
- Record
BIT-tomcat-2020-13943- Updated
- 2026-11-02
OSVCLSA-2025-1748282295 No score
Fix of 34 CVEs
- SECURITY UPDATE: Misc vulnerability fixes
- CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
- Update to 8.5.100
- debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
- debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
- CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
- Internal tests
- debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired
- Record
CLSA-2025-1748282295- Updated
- 2026-11-02
OSVMGASA-2020-0397 No score
Updated tomcat packages fix a security vulnerability
If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources (CVE-2020-13943).
- Record
MGASA-2020-0397- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1799-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2020:1799-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1842-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:1842-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11468-1 No score
tomcat-9.0.36-8.4 on GA media
These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11468-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13441-1 No score
tomcat10-10.1.14-1.1 on GA media
These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13441-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2996-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)
- Don't give write permissions for the tomcat group on files and directories where it's not needed (bsc#1172562)
- Use %tmpfiles_create macro in %post instead of calling systemd-tmpfiles directly
- Record
SUSE-SU-2020:2996-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3068-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)
- Record
SUSE-SU-2020:3068-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3069-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)
- Record
SUSE-SU-2020:3069-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0040-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Security issues fixed:
- CVE-2020-13943: Fixed a HTTP/2 Request mix-up (bsc#1177582).
- CVE-2020-17527: Fixed a HTTP/2 request header mix-up (bsc#1179602).
Non-security issue fixed:
- Removed tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from package. They're not used anymore becuse of systemd (bsc#1178396).
- Fixed 'tomcat-servlet-4_0-api' package alternatives to use and keep a symlink for compatibility (bsc#1092163).
- Don't give write permissions for the tomcat group on files and directories where it's not needed (bsc#1172562).
- Record
SUSE-SU-2021:0040-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1058-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.115:
- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2023-44487: Rapid reset attack (bsc#1216182).
- Record
SUSE-SU-2026:1058-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcat-coyoteMaven |
10.0.0-M1 to 10.0.0-M7 | 10.0.0-M8 |
org.apache.tomcat:tomcat-coyoteMaven |
9.0.0-M1 to 9.0.37 | 9.0.38 |
org.apache.tomcat:tomcat-coyoteMaven |
8.5.0 to 8.5.57 | 8.5.58 |
tomcatBitnami |
8.5.0 up to 8.5.1, 8.5.1 up to 8.5.2, 8.5.2 up to 8.5.3, 8.5.3 up to 8.5.4, 8.5.4 up to 8.5.5, 8.5.5 up to 8.5.6, 8.5.6 up to 8.5.7, 8.5.7 up to 8.5.8, 8.5.8 up to 8.5.9, 8.5.9 up to 8.5.10, 8.5.10 up to 8.5.11, 8.5.11 up to 8.5.12, 8.5.12 up to 8.5.13, 8.5.13 up to 8.5.14, 8.5.14 up to 8.5.15, 8.5.15 up to 8.5.16, 8.5.16 up to 8.5.17, 8.5.17 up to 8.5.18, 8.5.18 up to 8.5.19, 8.5.19 up to 8.5.20, 8.5.20 up to 8.5.21, 8.5.21 up to 8.5.22, 8.5.22 up to 8.5.23, 8.5.23 up to 8.5.24, 8.5.24 up to 8.5.25, 8.5.25 up to 8.5.26, 8.5.26 up to 8.5.27, 8.5.27 up to 8.5.28, 8.5.28 up to 8.5.29, 8.5.29 up to 8.5.30, 8.5.30 up to 8.5.31, 8.5.31 up to 8.5.32, 8.5.32 up to 8.5.33, 8.5.33 up to 8.5.34, 8.5.34 up to 8.5.35, 8.5.35 up to 8.5.36, 8.5.36 up to 8.5.37, 8.5.37 up to 8.5.38, 8.5.38 up to 8.5.39, 8.5.39 up to 8.5.40, 8.5.40 up to 8.5.41, 8.5.41 up to 8.5.42, 8.5.42 up to 8.5.43, 8.5.43 up to 8.5.44, 8.5.44 up to 8.5.45, 8.5.45 up to 8.5.46, 8.5.46 up to 8.5.47, 8.5.47 up to 8.5.48, 8.5.48 up to 8.5.49, 8.5.49 up to 8.5.50, 8.5.50 up to 8.5.51, 8.5.51 up to 8.5.52, 8.5.52 up to 8.5.53, 8.5.53 up to 8.5.54, 8.5.54 up to 8.5.55, 8.5.55 up to 8.5.56, 8.5.56 up to 8.5.57, 8.5.57 up to 8.5.58, 9.0.0 up to 9.0.38 | 8.5.18.5.28.5.38.5.48.5.58.5.68.5.78.5.88.5.98.5.108.5.118.5.128.5.138.5.148.5.158.5.168.5.178.5.188.5.198.5.208.5.218.5.228.5.238.5.248.5.258.5.268.5.278.5.288.5.298.5.308.5.318.5.328.5.338.5.348.5.358.5.368.5.378.5.388.5.398.5.408.5.418.5.428.5.438.5.448.5.458.5.468.5.478.5.488.5.498.5.508.5.518.5.528.5.538.5.548.5.558.5.568.5.578.5.589.0.38 |
libtomcat8-embed-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
libtomcat8-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8TuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-adminTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-commonTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-docsTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
Show 49 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat8-examplesTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-userTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat9Debian:12 |
before 9.0.38-1 | 9.0.38-1 |
tomcat9Debian:13 |
before 9.0.38-1 | 9.0.38-1 |
tomcat9Debian:14 |
before 9.0.38-1 | 9.0.38-1 |
tomcat8Debian:9 |
before 8.5.54-0+deb9u4, plus listed versions 8.5.14-18.5.14-1+deb9u18.5.14-1+deb9u28.5.14-1+deb9u38.5.14-2 Show 35 moreShow less8.5.15-18.5.16-18.5.21-18.5.23-18.5.24-18.5.24-28.5.24-2~bpo9+18.5.28-18.5.28-1~bpo9+18.5.29-18.5.29-1~bpo9+18.5.30-18.5.31-18.5.32-18.5.32-28.5.33-18.5.33-1~bpo9+18.5.34-18.5.34-1~bpo9+18.5.35-18.5.35-28.5.35-2~bpo9+18.5.35-38.5.37-18.5.37-1~bpo9+18.5.37-28.5.38-18.5.38-1~bpo9+18.5.38-28.5.38-2~bpo9+18.5.39-18.5.50-0+deb9u18.5.54-0+deb9u18.5.54-0+deb9u28.5.54-0+deb9u3 |
8.5.54-0+deb9u4 |
tomcat9Debian:10 |
before 9.0.31-1~deb10u3, plus listed versions 9.0.16-49.0.16-59.0.22-19.0.24-19.0.27-19.0.31-1~bpo10+19.0.31-1~deb10u19.0.31-1~deb10u2 |
9.0.31-1~deb10u3 |
org.apache.tomcat:tomcat-coyoteMaven |
10.0.0-M1 up to 10.0.0-M8, plus listed versions 10.0.0-M310.0.0-M410.0.0-M510.0.0-M610.0.0-M7 |
10.0.0-M8 |
org.apache.tomcat:tomcat-coyoteMaven |
9.0.0-M1 up to 9.0.38, plus listed versions 9.0.0.M19.0.0.M109.0.0.M119.0.0.M139.0.0.M15 Show 43 moreShow less9.0.0.M179.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.49.0.59.0.69.0.79.0.8 |
9.0.38 |
org.apache.tomcat:tomcat-coyoteMaven |
8.5.0 up to 8.5.58, plus listed versions 8.5.118.5.128.5.138.5.148.5.15 Show 40 moreShow less8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.68.5.88.5.9 |
8.5.58 |
tomcatMageia:7 |
before 9.0.38-1.mga7 | 9.0.38-1.mga7 |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:1.2.25-3.redhat_3.el7jws | 0:1.2.25-3.redhat_3.el7jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:1.2.25-3.redhat_3.el7jws | 0:1.2.25-3.redhat_3.el7jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:1.2.25-3.redhat_3.el8jws | 0:1.2.25-3.redhat_3.el8jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:1.2.25-3.redhat_3.el8jws | 0:1.2.25-3.redhat_3.el8jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
tomcatSUSE:Linux Enterprise Server 12 SP5 |
before 9.0.36-3.50.1 | 9.0.36-3.50.1 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 9.0.36-3.50.1 | 9.0.36-3.50.1 |
tomcatSUSE:Linux Enterprise Module for Web and Scripting 15 SP2 |
before 9.0.36-3.12.3 | 9.0.36-3.12.3 |
tomcatSUSE:Linux Enterprise Module for Web and Scripting 15 SP1 |
before 9.0.36-4.47.3 | 9.0.36-4.47.3 |
tomcatSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 9.0.36-3.74.1 | 9.0.36-3.74.1 |
tomcatSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 9.0.36-3.74.1 | 9.0.36-3.74.1 |
tomcatSUSE:Linux Enterprise Server 15-LTSS |
before 9.0.36-3.74.1 | 9.0.36-3.74.1 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 15 |
before 9.0.36-3.74.1 | 9.0.36-3.74.1 |
tomcatSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 9.0.115-3.160.1 | 9.0.115-3.160.1 |
tomcatSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 9.0.115-3.160.1 | 9.0.115-3.160.1 |
tomcatopenSUSE:Leap 15.2 |
before 9.0.36-lp152.2.10.1 | 9.0.36-lp152.2.10.1 |
tomcatopenSUSE:Leap 15.1 |
before 9.0.36-lp151.3.33.1 | 9.0.36-lp151.3.33.1 |
tomcatopenSUSE:Tumbleweed |
before 9.0.36-8.4 | 9.0.36-8.4 |
tomcat10openSUSE:Tumbleweed |
before 10.1.14-1.1 | 10.1.14-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-13943 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published October 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 52.6%, the 98th percentile. Fixed in org.apache.tomcat:tomcat-coyote 10.0.0-M8.
References
lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
lists.debian.org/debian-lts-announce/2020/10/msg00019.html
lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
debian.org/security/2021/dsa-4835
oracle.com/security-alerts/cpuApr2021.html
Show 128 moreShow less
security.netapp.com/advisory/ntap-20201016-0007
nvd.nist.gov/vuln/detail/CVE-2020-13943
github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb
errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html
security-tracker.debian.org/tracker/CVE-2020-13943
advisories.mageia.org/MGASA-2020-0397.html
bugs.mageia.org/show_bug.cgi?id=27396
tomcat.apache.org/security-9.html
access.redhat.com/errata/RHSA-2021:0494
bugzilla.redhat.com/show_bug.cgi?id=1887648
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0494.json
cve.org/CVERecord?id=CVE-2020-1971
openssl.org/news/secadv/20201208.txt
mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E
suse.com/support/update/announcement/2020/suse-su-20202996-1
bugzilla.suse.com/1172562