{"id":"CVE-2020-11996","aliases":["BIT-tomcat-2020-11996","CLSA-2025-1748282295","CLSA-2026-1794480983","DEBIAN-CVE-2020-11996","DLA-2279-1","DSA-4727-1","EUVD-2022-0828","GHSA-53hp-jpwq-2jgq","MGASA-2020-0331","RHSA-2020:5170","SUSE-SU-2020:1841-1","SUSE-SU-2020:1962-1","SUSE-SU-2020:1963-1","SUSE-SU-2020:1983-1","UBUNTU-CVE-2020-11996","USN-4596-1","openSUSE-SU-2020:1051-1","openSUSE-SU-2020:1063-1","openSUSE-SU-2024:11468-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Uncontrolled Resource Consumption in Apache Tomcat","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.26699,"percentile":0.98051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-400"],"published":"2020-06-26T16:27:20Z","modified":"2026-11-12T13:45:05Z","exploits":[{"source":"pocgithub","id":"rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996","title":"rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996","date":"2020-07-27","url":"https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["10.0.0-M5","9.0.35","8.5.55"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.0.0-M5","9.0.35","8.5.55"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["8.5.56","9.0.36"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.36-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.36-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.36-1"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-jboss-logging","fixed_in":["0:3.4.1-1.Final_redhat_00001.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-mod_cluster","fixed_in":["0:1.4.2-7.Final_redhat_00002.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-mod_cluster-tomcat","fixed_in":["0:1.4.2-7.Final_redhat_00002.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-lib","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-native","fixed_in":["0:1.2.25-2.redhat_2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-native-debuginfo","fixed_in":["0:1.2.25-2.redhat_2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.36-6.redhat_5.2.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-jboss-logging","fixed_in":["0:3.4.1-1.Final_redhat_00001.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-mod_cluster","fixed_in":["0:1.4.2-7.Final_redhat_00002.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-mod_cluster-tomcat","fixed_in":["0:1.4.2-7.Final_redhat_00002.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-lib","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-native","fixed_in":["0:1.2.25-2.redhat_2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-native-debuginfo","fixed_in":["0:1.2.25-2.redhat_2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.36-6.redhat_5.2.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-jboss-logging","fixed_in":["0:3.4.1-1.Final_redhat_00001.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-mod_cluster","fixed_in":["0:1.4.2-7.Final_redhat_00002.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-mod_cluster-tomcat","fixed_in":["0:1.4.2-7.Final_redhat_00002.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-lib","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-native","fixed_in":["0:1.2.25-2.redhat_2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-native-debuginfo","fixed_in":["0:1.2.25-2.redhat_2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.36-6.redhat_5.2.el8jws"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tomcat","fixed_in":["9.0.36-3.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tomcat","fixed_in":["9.0.36-3.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tomcat","fixed_in":["9.0.36-3.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tomcat","fixed_in":["9.0.36-3.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"tomcat","fixed_in":["9.0.36-4.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"tomcat","fixed_in":["9.0.36-3.42.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"tomcat","fixed_in":["9.0.36-3.42.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","fixed_in":["9.0.36-3.42.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"tomcat","fixed_in":["9.0.36-3.42.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.42.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.42.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"tomcat","fixed_in":["9.0.36-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","fixed_in":["9.0.31-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"tomcat","fixed_in":["9.0.36-lp151.3.24.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"tomcat","fixed_in":["9.0.36-lp152.2.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"last_affected":"10.0.0-M4"},{"fixed":"10.0.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"last_affected":"10.0.0-M4"},{"fixed":"10.0.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.55"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0"},{"fixed":"8.5.56"},{"introduced":"9.0.0"},{"fixed":"9.0.36"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.3"}]}],"versions":["8.5.46","8.5.46-tuxcare.1","8.5.46-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.3"}]}],"versions":["8.5.46","8.5.46-tuxcare.1","8.5.46-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.3"}]}],"versions":["8.5.46","8.5.46-tuxcare.1","8.5.46-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.54-0+deb9u2"}]}],"versions":["8.5.14-1","8.5.14-1+deb9u1","8.5.14-1+deb9u2","8.5.14-1+deb9u3","8.5.14-2","8.5.15-1","8.5.16-1","8.5.21-1","8.5.23-1","8.5.24-1","8.5.24-2","8.5.24-2~bpo9+1","8.5.28-1","8.5.28-1~bpo9+1","8.5.29-1","8.5.29-1~bpo9+1","8.5.30-1","8.5.31-1","8.5.32-1","8.5.32-2","8.5.33-1","8.5.33-1~bpo9+1","8.5.34-1","8.5.34-1~bpo9+1","8.5.35-1","8.5.35-2","8.5.35-2~bpo9+1","8.5.35-3","8.5.37-1","8.5.37-1~bpo9+1","8.5.37-2","8.5.38-1","8.5.38-1~bpo9+1","8.5.38-2","8.5.38-2~bpo9+1","8.5.39-1","8.5.50-0+deb9u1","8.5.54-0+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u2"}]}],"versions":["9.0.16-4","9.0.16-5","9.0.22-1","9.0.24-1","9.0.27-1","9.0.31-1~bpo10+1","9.0.31-1~deb10u1"],"bundled":4},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.0.0-M5"}]}],"versions":["10.0.0-M1","10.0.0-M3","10.0.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.35"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.55"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.6","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.0.0-M5"}]}],"versions":["10.0.0-M1","10.0.0-M3","10.0.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.35"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.55"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.6","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Mageia:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.37-1.2.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-1.Final_redhat_00001.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-7.Final_redhat_00002.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-mod_cluster-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-7.Final_redhat_00002.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-2.redhat_2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-2.redhat_2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el6","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-1.Final_redhat_00001.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-7.Final_redhat_00002.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-mod_cluster-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-7.Final_redhat_00002.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-2.redhat_2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-2.redhat_2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-1.Final_redhat_00001.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-7.Final_redhat_00002.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-mod_cluster-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-7.Final_redhat_00002.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-2.redhat_2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-2.redhat_2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-6.redhat_5.2.el8jws"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-4.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.42.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.42.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.42.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.42.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.42.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.42.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2","8.5.39-1ubuntu1~18.04.3+esm3","8.5.39-1ubuntu1~18.04.3+esm4","8.5.39-1ubuntu1~18.04.3+esm5","8.5.39-1ubuntu1~18.04.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6","9.0.16-3ubuntu0.18.04.2+esm7","9.0.16-3ubuntu0.18.04.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.1"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.1"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-lp151.3.24.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-8.4"}]}],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"apache tomcat"},{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"oncommand_system_manager"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"mysql_enterprise_monitor"},{"vendor":"oracle","product":"siebel_ui_framework"},{"vendor":"oracle","product":"workload_manager"}],"references":[{"url":"https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb4ee49ecc4c59620ffd5e66e84a17e526c2c3cfa95d0cd682d90d338%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb820f1a2a02bf07414be12c653c2ab5321fd87b9bf6c5e635c53ff4b%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r74f5a8204efe574cbfcd95b2a16236fe95beb45c4d9fee3dc789dca9%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rea65d6ef2e45dd1c45faae83922042732866c7b88fa109b76c83db52%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc80b96b4b96618b2b7461cb90664a428cfd6605eea9f74e51b792542%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r93ca628ef3a4530dfe5ac49fddc795f0920a4b2a408b57a30926a42b%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff1057115008100561%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9ad911fe49450ed9405827af0e7a74104041081ff91864b1f2546bbd%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ref0339792ac6dac1dba83c071a727ad72380899bde60f6aaad4031b9%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r6c29801370a36c1a5159679269777ad0c73276d3015b8bbefea66e5c%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4727","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200709-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4596-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r5a4f80a6acc6607d61dae424b643b594c6188dd4e1eff04705c10db2%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11996","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd@%3Cnotifications.ofbiz.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5a4f80a6acc6607d61dae424b643b594c6188dd4e1eff04705c10db2@%3Cnotifications.ofbiz.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6c29801370a36c1a5159679269777ad0c73276d3015b8bbefea66e5c@%3Cnotifications.ofbiz.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r74f5a8204efe574cbfcd95b2a16236fe95beb45c4d9fee3dc789dca9@%3Ccommits.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff1057115008100561@%3Ccommits.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r93ca628ef3a4530dfe5ac49fddc795f0920a4b2a408b57a30926a42b@%3Ccommits.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r9ad911fe49450ed9405827af0e7a74104041081ff91864b1f2546bbd@%3Cnotifications.ofbiz.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/rb4ee49ecc4c59620ffd5e66e84a17e526c2c3cfa95d0cd682d90d338@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/rb820f1a2a02bf07414be12c653c2ab5321fd87b9bf6c5e635c53ff4b@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/rc80b96b4b96618b2b7461cb90664a428cfd6605eea9f74e51b792542@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/rea65d6ef2e45dd1c45faae83922042732866c7b88fa109b76c83db52@%3Cnotifications.ofbiz.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/ref0339792ac6dac1dba83c071a727ad72380899bde60f6aaad4031b9@%3Cnotifications.ofbiz.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/9434a44d3449d620b1be70206819f8275b4a7509","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b0c976","tags":["web","report"]},{"url":"https://usn.ubuntu.com/4596-1","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20200709-0002","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/c8acd2ab7371e39aeca7c306f3b5380f00afe552","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-53hp-jpwq-2jgq"},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-11996","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0331.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26862","tags":["report"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.36","tags":["web","article"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5170","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1851420","tags":["report"]},{"url":"https://issues.redhat.com/browse/JWS-1050","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-1445","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5170.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11996","tags":["advisory","report"]},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/202006.mbox/%3Cfd56bc1d-1219-605b-99c7-946bf7bd8ad4%40apache.org%3E","tags":["article"]},{"url":"http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M6","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.56","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201841-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173389","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201962-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201963-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201983-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-11996","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/06/25/6","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4596-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-9484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13935","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3V7X3IWA53FRK7AHHX6TLLX6ZDE5CAEM/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BNVJYIB3HTCMCBROV6W6YIAOK6E5VDNW/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-11996","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2020-06-26T16:27:20Z","modified":"2026-10-08T21:13:56.997Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2022-0828","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2020-06-26T16:27:20Z","modified":"2026-10-08T21:13:56Z","updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-53hp-jpwq-2jgq","title":"Uncontrolled Resource Consumption in Apache Tomcat","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2022-02-09T23:01:22Z","modified":"2026-06-11T14:28:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:40:26.12116Z"}],"nvd":[{"id":"CVE-2020-11996","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2020-06-26T17:15:10.153Z","modified":"2026-10-08T22:16:56.027Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"CVE-2020-11996","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2020-06-26T17:15:10.153Z","modified":"2026-10-24T10:30:19.981280023Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-11996","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2020-06-26T17:15:10.153Z","modified":"2026-10-26T12:01:25.813023733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-53hp-jpwq-2jgq","title":"Uncontrolled Resource Consumption in Apache Tomcat","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2022-02-09T23:01:22Z","modified":"2026-06-11T14:45:08.723638939Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"RHSA-2020:5170","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.4 security release","status":"published","published":"2024-09-13T22:10:45Z","modified":"2026-08-05T10:08:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2020-11996","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2020-06-26T17:15:00Z","modified":"2026-07-15T19:45:11.349618701Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"BIT-tomcat-2020-11996","description":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0 to 10.0.0, 9.0.0 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","status":"published","published":"2024-03-06T11:11:51.472Z","modified":"2026-09-08T08:48:20.7722817Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1794480983","title":"TuxCare security update for 3 packages (2 CVEs)","description":"TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 8.5.46-tuxcare.3.","status":"published","published":"2026-11-12T11:56:24Z","modified":"2026-11-12T13:45:05.750689048Z","updated_at":"2026-11-12T13:52:20.648435Z"},{"id":"DLA-2279-1","title":"tomcat8 - security update","status":"published","published":"2020-07-12T00:00:00Z","modified":"2026-03-09T01:19:29.179002Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4727-1","title":"tomcat9 - security update","status":"published","published":"2020-07-17T00:00:00Z","modified":"2026-03-09T02:08:56.423819Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0331","title":"Updated tomcat packages fix security vulnerability","description":"A specially crafted sequence of HTTP/2 requests could trigger high CPU usage\nfor several seconds. If a sufficient number of such requests were made on\nconcurrent HTTP/2 connections, the server could become unresponsive\n(CVE-2020-11996).\n\nAn h2c direct connection did not release the HTTP/1.1 processor after the\nupgrade to HTTP/2. If a sufficient number of such requests were made, an\nOutOfMemoryException could occur leading to a denial of service\n(CVE-2020-13934).\n\nThe payload length in a WebSocket frame was not correctly validated. Invalid\npayload lengths could trigger an infinite loop. Multiple requests with invalid\npayload lengths could lead to a denial of service (CVE-2020-13935).\n","status":"published","published":"2020-08-18T18:47:25Z","modified":"2026-04-16T04:42:39.110821968Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:1051-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nTomcat was updated to 9.0.36 See changelog at\n\n- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU\n  usage for several seconds making potentially the server unresponsive (bsc#1173389).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-07-23T18:21:33Z","modified":"2025-05-07T18:11:20.608059Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1063-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\t  \nTomcat was updated to 9.0.36 See changelog at\n\n- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU\n  usage for several seconds making potentially the server unresponsive (bsc#1173389).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-07-26T10:20:20Z","modified":"2026-02-04T02:48:58.923221Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11468-1","title":"tomcat-9.0.36-8.4 on GA media","description":"These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:40.917277Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2020:1841-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nTomcat was updated to 9.0.36 See changelog at\n\n- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU\n  usage for several seconds making potentially the server unresponsive (bsc#1173389).\t  \n","status":"published","published":"2020-07-03T20:40:14Z","modified":"2026-02-04T04:21:54.667149Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1962-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nTomcat was updated to 9.0.36 See changelog at\n\n- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU\n  usage for several seconds making potentially the server unresponsive (bsc#1173389).\n","status":"published","published":"2020-07-20T15:30:02Z","modified":"2026-02-04T02:17:31.897833Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1963-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nTomcat was updated to 9.0.36 See changelog at\n\n- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU\n  usage for several seconds making potentially the server unresponsive (bsc#1173389).\t  \n","status":"published","published":"2020-07-20T15:30:52Z","modified":"2026-02-04T04:21:21.890986Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1983-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\t  \nTomcat was updated to 9.0.36 See changelog at\n\n- CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU\n  usage for several seconds making potentially the server unresponsive (bsc#1173389).\n","status":"published","published":"2020-07-21T06:31:50Z","modified":"2026-02-04T03:09:48.349575Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4596-1","title":"tomcat9 vulnerabilities","description":"It was discovered that Tomcat did not properly manage HTTP/2 streams. An \nattacker could possibly use this to cause Tomcat to consume resources, \nresulting in a denial of service. (CVE-2020-11996)\n\nIt was discovered that Tomcat did not properly release the HTTP/1.1 \nprocessor after the upgrade to HTTP/2. An attacker could possibly use this\nto generate an OutOfMemoryException, resulting in a denial of service. \n(CVE-2020-13934)\n\nIt was discovered that Tomcat did not properly validate the payload length\nin a WebSocket frame. An attacker could possibly use this to trigger an\ninfinite loop, resulting in a denial of service. (CVE-2020-13935)\n\nIt was discovered that Tomcat did not properly deserialize untrusted data.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-9484)\n","status":"published","published":"2020-10-21T13:55:35Z","modified":"2026-04-27T15:48:48.204382856Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}