CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 9.0.0 through 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

• SECURITY UPDATE: Misc vulnerability fixes
  • CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
• Update to 8.5.100
  • debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
  • debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
  • CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
• Internal tests
  • debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired

• SECURITY UPDATE: denial of service via crafted WebSocket frame with a 64-bit payload length whose most significant bit is set. The extended payload length read in WsFrameBase.processRemainingHeader() was assembled into a Java long without validation. With bit 63 set the value became negative, which the consumer then used as a loop bound, causing an infinite loop and exhausting CPU on the server thread. Affects Apache Tomcat 7.0.0 to 7.0.104, 8.5.0 to 8.5.56, 9.0.0.M1 to 9.0.36, and 10.0.0-M1 to 10.0.0-M6.
  • debian/patches/CVE-2020-13935.patch: validate the 64-bit payload length in processRemainingHeader() and reject frames with a negative value by throwing a WsIOException carrying a PROTOCOL_ERROR close reason; add the wsFrame.payloadMsbInvalid message to LocalStrings.properties. Also fold the companion fix 4c04982870 to apply the same validation to the legacy org/apache/catalina/websocket/WsFrame parser (still packaged in catalina.jar via WebSocketServlet), and the regression follow-up 34d19fbe24 in WsFrameBase.byteArrayToLong() (0xFF -> 0xFFL) that prevents silent corruption of payload lengths >= 4 bytes from int-shift promotion. Additionally fold b517002093 to apply the same 0xFF -> 0xFFL fix to the parallel helper Conversions.byteArrayToLong() in java/org/apache/catalina/util/Conversions.java, which is the helper used by the legacy WsFrame parser; without it the new < 0 check in the legacy parser would falsely reject legitimate large frames. Backport of upstream commits f9f75c14, 34d19fbe24, 4c04982870 and b517002093 (https://github.com/apache/tomcat/commit/f9f75c14 https://github.com/apache/tomcat/commit/34d19fbe24 https://github.com/apache/tomcat/commit/4c04982870 https://github.com/apache/tomcat/commit/b517002093)
  • CVE-2020-13935

TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4.

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive (CVE-2020-11996).

An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service (CVE-2020-13934).

The payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service (CVE-2020-13935).

This update for tomcat fixes the following issues:

• Fixed CVEs:
  • CVE-2020-13934 (bsc#1174121)
  • CVE-2020-13935 (bsc#1174117)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for tomcat fixes the following issues:

• Fixed CVEs:
  • CVE-2020-13934 (bsc#1174121)
  • CVE-2020-13935 (bsc#1174117)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the tomcat-9.0.43-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.

This update for tomcat fixes the following issues:

• Fixed CVEs:
  • CVE-2020-13934 (bsc#1174121)
  • CVE-2020-13935 (bsc#1174117)

This update for tomcat fixes the following issues:

• Fixed CVEs: CVE-2020-13934 (bsc#1174121) CVE-2020-13935 (bsc#1174117)

This update for tomcat fixes the following issues:

• Fixed CVEs:
  • CVE-2020-13934 (bsc#1174121)
  • CVE-2020-13935 (bsc#1174117)

This update for tomcat fixes the following issues:

• Fixed CVEs:
  • CVE-2020-13934 (bsc#1174121)
  • CVE-2020-13935 (bsc#1174117)

This update for tomcat fixes the following issues:

• CVE-2020-1935: Fixed an HTTP request smuggling vulnerability (bsc#1164860).
• CVE-2020-13935: Fixed a WebSocket DoS (bsc#1174117).

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.115:

• CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
• CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
• CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
• CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
• CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
• CVE-2023-44487: Rapid reset attack (bsc#1216182).

It was discovered that Tomcat incorrectly validated the payload length in a WebSocket frame. A remote attacker could possibly use this issue to cause Tomcat to hang, resulting in a denial of service. (CVE-2020-13935)

It was discovered that Tomcat incorrectly handled HTTP header parsing. In certain environments where Tomcat is located behind a reverse proxy, a remote attacker could possibly use this issue to perform HTTP Reqest Smuggling. (CVE-2020-1935)

It was discovered that Tomcat incorrectly handled certain uncommon PersistenceManager with FileStore configurations. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2020-9484)

It was discovered that Tomcat did not properly manage HTTP/2 streams. An attacker could possibly use this to cause Tomcat to consume resources, resulting in a denial of service. (CVE-2020-11996)

It was discovered that Tomcat did not properly release the HTTP/1.1 processor after the upgrade to HTTP/2. An attacker could possibly use this to generate an OutOfMemoryException, resulting in a denial of service. (CVE-2020-13934)

It was discovered that Tomcat did not properly validate the payload length in a WebSocket frame. An attacker could possibly use this to trigger an infinite loop, resulting in a denial of service. (CVE-2020-13935)

It was discovered that Tomcat did not properly deserialize untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-9484)