{"id":"CVE-2020-13943","aliases":["BIT-tomcat-2020-13943","CLSA-2025-1748282295","DEBIAN-CVE-2020-13943","DLA-2407-1","DSA-4835-1","EUVD-2022-0967","GHSA-f268-65qc-98vg","MGASA-2020-0397","RHSA-2021:0494","SUSE-SU-2020:2996-1","SUSE-SU-2020:3068-1","SUSE-SU-2020:3069-1","SUSE-SU-2021:0040-1","SUSE-SU-2026:1058-1","openSUSE-SU-2020:1799-1","openSUSE-SU-2020:1842-1","openSUSE-SU-2024:11468-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-13","score":0.52639,"percentile":0.98985,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2020-10-12T13:46:47Z","modified":"2026-10-26T12:00:35Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","fixed_in":["10.0.0-M8","9.0.38","8.5.58"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["8.5.1","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.5.10","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.17","8.5.18","8.5.19","8.5.20","8.5.21","8.5.22","8.5.23","8.5.24","8.5.25","8.5.26","8.5.27","8.5.28","8.5.29","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.36","8.5.37","8.5.38","8.5.39","8.5.40","8.5.41","8.5.42","8.5.43","8.5.44","8.5.45","8.5.46","8.5.47","8.5.48","8.5.49","8.5.50","8.5.51","8.5.52","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","9.0.38"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.38-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.38-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.38-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"tomcat8","fixed_in":["8.5.54-0+deb9u4"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"tomcat","fixed_in":["9.0.38-1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"tomcat","fixed_in":["9.0.36-3.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"tomcat","fixed_in":["9.0.36-4.47.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"tomcat","fixed_in":["9.0.36-lp152.2.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"tomcat","fixed_in":["9.0.36-lp151.3.33.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"last_affected":"10.0.0-M7"},{"fixed":"10.0.0-M8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"last_affected":"9.0.37"},{"fixed":"9.0.38"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.57"},{"fixed":"8.5.58"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0"},{"fixed":"8.5.1"},{"introduced":"8.5.1"},{"fixed":"8.5.2"},{"introduced":"8.5.2"},{"fixed":"8.5.3"},{"introduced":"8.5.3"},{"fixed":"8.5.4"},{"introduced":"8.5.4"},{"fixed":"8.5.5"},{"introduced":"8.5.5"},{"fixed":"8.5.6"},{"introduced":"8.5.6"},{"fixed":"8.5.7"},{"introduced":"8.5.7"},{"fixed":"8.5.8"},{"introduced":"8.5.8"},{"fixed":"8.5.9"},{"introduced":"8.5.9"},{"fixed":"8.5.10"},{"introduced":"8.5.10"},{"fixed":"8.5.11"},{"introduced":"8.5.11"},{"fixed":"8.5.12"},{"introduced":"8.5.12"},{"fixed":"8.5.13"},{"introduced":"8.5.13"},{"fixed":"8.5.14"},{"introduced":"8.5.14"},{"fixed":"8.5.15"},{"introduced":"8.5.15"},{"fixed":"8.5.16"},{"introduced":"8.5.16"},{"fixed":"8.5.17"},{"introduced":"8.5.17"},{"fixed":"8.5.18"},{"introduced":"8.5.18"},{"fixed":"8.5.19"},{"introduced":"8.5.19"},{"fixed":"8.5.20"},{"introduced":"8.5.20"},{"fixed":"8.5.21"},{"introduced":"8.5.21"},{"fixed":"8.5.22"},{"introduced":"8.5.22"},{"fixed":"8.5.23"},{"introduced":"8.5.23"},{"fixed":"8.5.24"},{"introduced":"8.5.24"},{"fixed":"8.5.25"},{"introduced":"8.5.25"},{"fixed":"8.5.26"},{"introduced":"8.5.26"},{"fixed":"8.5.27"},{"introduced":"8.5.27"},{"fixed":"8.5.28"},{"introduced":"8.5.28"},{"fixed":"8.5.29"},{"introduced":"8.5.29"},{"fixed":"8.5.30"},{"introduced":"8.5.30"},{"fixed":"8.5.31"},{"introduced":"8.5.31"},{"fixed":"8.5.32"},{"introduced":"8.5.32"},{"fixed":"8.5.33"},{"introduced":"8.5.33"},{"fixed":"8.5.34"},{"introduced":"8.5.34"},{"fixed":"8.5.35"},{"introduced":"8.5.35"},{"fixed":"8.5.36"},{"introduced":"8.5.36"},{"fixed":"8.5.37"},{"introduced":"8.5.37"},{"fixed":"8.5.38"},{"introduced":"8.5.38"},{"fixed":"8.5.39"},{"introduced":"8.5.39"},{"fixed":"8.5.40"},{"introduced":"8.5.40"},{"fixed":"8.5.41"},{"introduced":"8.5.41"},{"fixed":"8.5.42"},{"introduced":"8.5.42"},{"fixed":"8.5.43"},{"introduced":"8.5.43"},{"fixed":"8.5.44"},{"introduced":"8.5.44"},{"fixed":"8.5.45"},{"introduced":"8.5.45"},{"fixed":"8.5.46"},{"introduced":"8.5.46"},{"fixed":"8.5.47"},{"introduced":"8.5.47"},{"fixed":"8.5.48"},{"introduced":"8.5.48"},{"fixed":"8.5.49"},{"introduced":"8.5.49"},{"fixed":"8.5.50"},{"introduced":"8.5.50"},{"fixed":"8.5.51"},{"introduced":"8.5.51"},{"fixed":"8.5.52"},{"introduced":"8.5.52"},{"fixed":"8.5.53"},{"introduced":"8.5.53"},{"fixed":"8.5.54"},{"introduced":"8.5.54"},{"fixed":"8.5.55"},{"introduced":"8.5.55"},{"fixed":"8.5.56"},{"introduced":"8.5.56"},{"fixed":"8.5.57"},{"introduced":"8.5.57"},{"fixed":"8.5.58"},{"introduced":"9.0.0"},{"fixed":"9.0.38"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.38-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.38-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.38-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.54-0+deb9u4"}]}],"versions":["8.5.14-1","8.5.14-1+deb9u1","8.5.14-1+deb9u2","8.5.14-1+deb9u3","8.5.14-2","8.5.15-1","8.5.16-1","8.5.21-1","8.5.23-1","8.5.24-1","8.5.24-2","8.5.24-2~bpo9+1","8.5.28-1","8.5.28-1~bpo9+1","8.5.29-1","8.5.29-1~bpo9+1","8.5.30-1","8.5.31-1","8.5.32-1","8.5.32-2","8.5.33-1","8.5.33-1~bpo9+1","8.5.34-1","8.5.34-1~bpo9+1","8.5.35-1","8.5.35-2","8.5.35-2~bpo9+1","8.5.35-3","8.5.37-1","8.5.37-1~bpo9+1","8.5.37-2","8.5.38-1","8.5.38-1~bpo9+1","8.5.38-2","8.5.38-2~bpo9+1","8.5.39-1","8.5.50-0+deb9u1","8.5.54-0+deb9u1","8.5.54-0+deb9u2","8.5.54-0+deb9u3"]},{"source":"osv","ecosystem":"Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u3"}]}],"versions":["9.0.16-4","9.0.16-5","9.0.22-1","9.0.24-1","9.0.27-1","9.0.31-1~bpo10+1","9.0.31-1~deb10u1","9.0.31-1~deb10u2"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.0.0-M8"}]}],"versions":["10.0.0-M1","10.0.0-M3","10.0.0-M4","10.0.0-M5","10.0.0-M6","10.0.0-M7"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.38"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.58"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.6","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Mageia:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.38-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-3.redhat_3.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-3.redhat_3.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-3.redhat_3.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.25-3.redhat_3.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.4::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.36-9.redhat_8.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-4.47.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-lp152.2.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-lp151.3.33.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-8.4"}]}],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"debian","product":"debian_linux"},{"vendor":"oracle","product":"instantis_enterprisetrack"},{"vendor":"oracle","product":"sd-wan_edge"}],"references":[{"url":"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://www.debian.org/security/2021/dsa-4835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13943","tags":["web","advisory"]},{"url":"https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dcb292a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f268-65qc-98vg"},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13943","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0007","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0397.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27396","tags":["report"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38","tags":["web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0494","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1887648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1903409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1904221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917209","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0494.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1971","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1971","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1971","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20201208.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13943","tags":["advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E","tags":["article"]},{"url":"http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-17527","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-17527","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17527","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60","tags":["article"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-24122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-24122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24122","tags":["advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E","tags":["article"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202996-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172562","tags":["report"]},{"url":"https://bugzilla.suse.com/1177582","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203068-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203069-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210040-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092163","tags":["report"]},{"url":"https://bugzilla.suse.com/1178396","tags":["report"]},{"url":"https://bugzilla.suse.com/1179602","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216182","tags":["report"]},{"url":"https://bugzilla.suse.com/1243895","tags":["report"]},{"url":"https://bugzilla.suse.com/1246318","tags":["report"]},{"url":"https://bugzilla.suse.com/1246389","tags":["report"]},{"url":"https://bugzilla.suse.com/1258371","tags":["report"]},{"url":"https://bugzilla.suse.com/1258385","tags":["report"]},{"url":"https://bugzilla.suse.com/1259224","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24733","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4R6SGGLLSOWWSBNVPTFE4HEM6542AMI5/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5AUBSMXMEYUIFU7NFNEUGM4PNZHW5RBO/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-13943","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","status":"published","published":"2020-10-12T13:46:47Z","modified":"2026-10-08T21:13:52.499Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2022-0967","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","status":"published","published":"2020-10-12T13:46:47Z","modified":"2026-10-08T21:13:52Z","updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-f268-65qc-98vg","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","status":"published","published":"2022-02-09T23:03:53Z","modified":"2023-09-27T09:47:19Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2020-13943","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","status":"published","published":"2020-10-12T14:15:12.183Z","modified":"2026-10-08T22:16:56.9Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:19.351389Z"}],"osv":[{"id":"CVE-2020-13943","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","status":"published","published":"2020-10-12T14:15:12.183Z","modified":"2026-10-24T10:30:40.880501072Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13943","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","status":"published","published":"2020-10-12T14:15:12.183Z","modified":"2026-10-26T12:00:35.07590491Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-f268-65qc-98vg","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","status":"published","published":"2022-02-09T23:03:53Z","modified":"2024-02-16T08:04:48.542136Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"RHSA-2021:0494","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update","status":"published","published":"2024-09-13T22:11:51Z","modified":"2026-10-02T10:01:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"BIT-tomcat-2020-13943","description":"If an HTTP/2 client connecting to Apache Tomcat 9.0.0 through 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","status":"published","published":"2024-03-06T11:11:40.396Z","modified":"2026-09-08T08:48:20.780617782Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"DLA-2407-1","title":"tomcat8 - security update","status":"published","published":"2020-10-14T00:00:00Z","modified":"2026-03-09T01:23:03.874247Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4835-1","title":"tomcat9 - security update","status":"published","published":"2021-01-22T00:00:00Z","modified":"2026-03-09T02:09:32.80137Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0397","title":"Updated tomcat packages fix a security vulnerability","description":"If an HTTP/2 client exceeded the agreed maximum number of concurrent streams\nfor a connection (in violation of the HTTP/2 protocol), it was possible that a\nsubsequent request made on that connection could contain HTTP headers -\nincluding HTTP/2 pseudo headers - from a previous request rather than the\nintended headers. This could lead to users seeing responses for unexpected\nresources (CVE-2020-13943).\n","status":"published","published":"2020-10-29T22:25:06Z","modified":"2026-04-16T04:41:16.882000236Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1799-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-11-01T05:23:52Z","modified":"2026-02-04T04:20:57.306394Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1842-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-11-05T19:25:55Z","modified":"2026-02-04T04:33:34.294966Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11468-1","title":"tomcat-9.0.36-8.4 on GA media","description":"These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:40.917277Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2020:2996-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)\n- Don't give write permissions for the tomcat group on files and\n  directories where it's not needed (bsc#1172562)\n- Use %tmpfiles_create macro in %post instead of calling\n  systemd-tmpfiles directly  \n","status":"published","published":"2020-10-22T08:04:00Z","modified":"2026-02-04T02:18:10.560831Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3068-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)\n","status":"published","published":"2020-10-28T10:46:20Z","modified":"2026-02-04T03:24:01.793629Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3069-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)\n","status":"published","published":"2020-10-28T10:46:29Z","modified":"2026-02-04T02:54:50.831337Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2021:0040-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-13943: Fixed a HTTP/2 Request mix-up (bsc#1177582).\n- CVE-2020-17527: Fixed a HTTP/2 request header mix-up (bsc#1179602).\n\nNon-security issue fixed:\n\n- Removed tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from package. They're not used anymore becuse of systemd (bsc#1178396).\n- Fixed 'tomcat-servlet-4_0-api' package alternatives to use and keep a symlink for compatibility (bsc#1092163).\n- Don't give write permissions for the tomcat group on files and directories where it's not needed (bsc#1172562).\n","status":"published","published":"2021-01-07T10:51:19Z","modified":"2026-02-04T02:40:32.738648Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2026:1058-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdate to Tomcat 9.0.115:\n\n- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).\n- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash\n  (bsc#1246389).\n- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).\n- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).\n- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).\n- CVE-2023-44487: Rapid reset attack (bsc#1216182).\n","status":"published","published":"2026-03-26T09:46:45Z","modified":"2026-03-27T08:48:24.814862Z","updated_at":"2026-11-02T15:54:01.262144Z"}]}}