CVE-2020-13943

{"containers": {"cna": {"affected": [{"product": "Apache Tomcat", "vendor": "n/a", "versions": [{"status": "affected", "version": "Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"}]}], "descriptions": [{"lang": "en", "value": "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-06-14T17:20:16.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E"}, {"name": "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html"}, {"name": "openSUSE-SU-2020:1799", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html"}, {"name": "openSUSE-SU-2020:1842", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html"}, {"name": "DSA-4835", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2021/dsa-4835"}, {"tags": ["x_refsource_MISC"], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20201016-0007/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2020-13943", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Tomcat", "version": {"version_data": [{"version_value": "Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E", "refsource": "MISC", "url": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E"}, {"name": "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html"}, {"name": "openSUSE-SU-2020:1799", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html"}, {"name": "openSUSE-SU-2020:1842", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html"}, {"name": "DSA-4835", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2021/dsa-4835"}, {"name": "https://www.oracle.com/security-alerts/cpuApr2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"}, {"name": "https://security.netapp.com/advisory/ntap-20201016-0007/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20201016-0007/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T12:32:14.470Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E"}, {"name": "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html"}, {"name": "openSUSE-SU-2020:1799", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html"}, {"name": "openSUSE-SU-2020:1842", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html"}, {"name": "DSA-4835", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2021/dsa-4835"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20201016-0007/"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-13943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T21:06:44.131648Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:13:52.499Z"}}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2020-13943", "datePublished": "2020-10-12T13:46:47.000Z", "dateReserved": "2020-06-08T00:00:00.000Z", "dateUpdated": "2026-10-08T21:13:52.499Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html", "name": "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html", "name": "openSUSE-SU-2020:1799", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"]}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html", "name": "openSUSE-SU-2020:1842", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"]}, {"url": "https://www.debian.org/security/2021/dsa-4835", "name": "DSA-4835", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"]}, {"url": "https://www.oracle.com/security-alerts/cpuApr2021.html", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20201016-0007/", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T12:32:14.470Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-13943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T21:06:44.131648Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:06:44.687Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"}]}], "references": [{"url": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E", "tags": ["x_refsource_MISC"]}, {"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html", "name": "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html", "name": "openSUSE-SU-2020:1799", "tags": ["vendor-advisory", "x_refsource_SUSE"]}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html", "name": "openSUSE-SU-2020:1842", "tags": ["vendor-advisory", "x_refsource_SUSE"]}, {"url": "https://www.debian.org/security/2021/dsa-4835", "name": "DSA-4835", "tags": ["vendor-advisory", "x_refsource_DEBIAN"]}, {"url": "https://www.oracle.com/security-alerts/cpuApr2021.html", "tags": ["x_refsource_MISC"]}, {"url": "https://security.netapp.com/advisory/ntap-20201016-0007/", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Information Disclosure"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2021-06-14T17:20:16.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"}]}, "product_name": "Apache Tomcat"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E", "name": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E", "refsource": "MISC"}, {"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html", "name": "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update", "refsource": "MLIST"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html", "name": "openSUSE-SU-2020:1799", "refsource": "SUSE"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html", "name": "openSUSE-SU-2020:1842", "refsource": "SUSE"}, {"url": "https://www.debian.org/security/2021/dsa-4835", "name": "DSA-4835", "refsource": "DEBIAN"}, {"url": "https://www.oracle.com/security-alerts/cpuApr2021.html", "name": "https://www.oracle.com/security-alerts/cpuApr2021.html", "refsource": "MISC"}, {"url": "https://security.netapp.com/advisory/ntap-20201016-0007/", "name": "https://security.netapp.com/advisory/ntap-20201016-0007/", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2020-13943", "STATE": "PUBLIC", "ASSIGNER": "security@apache.org"}}}}, "cveMetadata": {"cveId": "CVE-2020-13943", "state": "PUBLISHED", "dateUpdated": "2026-10-08T21:13:52.499Z", "dateReserved": "2020-06-08T00:00:00.000Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2020-10-12T13:46:47.000Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Apache Tomcat", "vendor": "n/a", "versions": [{"status": "affected", "version": "Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "69A7FC28-A0EC-4516-9776-700343D2F4DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "18814653-6D44-47D9-A2F5-89C5AFB255F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "D4D811A9-4988-4C11-AA27-F5BE2B93D8D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*", "matchCriteriaId": "FAEF824D-7E95-4BC1-8DBB-787DCE595E21", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*", "matchCriteriaId": "97F4A2B3-DB1D-4D0B-B5FF-7EE2A0D291BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*", "matchCriteriaId": "0B461D5A-1208-498F-B551-46C6D514AC2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*", "matchCriteriaId": "598E5D91-0165-4D55-9EDD-EBB5AAAD1172", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*", "matchCriteriaId": "4B6B61B7-09A3-41C8-8333-0417C14CC87E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*", "matchCriteriaId": "95A139BA-CD3C-42F5-88BA-BE7BE58246D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*", "matchCriteriaId": "876EADA5-60AD-4849-BE10-61C75AA75053", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*", "matchCriteriaId": "1814F8DE-2060-411F-9FCC-6EC42AF5663D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*", "matchCriteriaId": "1AF6DBF7-BB0A-4AE6-84DA-51428ACF47CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*", "matchCriteriaId": "A34F72ED-04FE-4EDE-BB18-BE8B1E99EEF1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*", "matchCriteriaId": "3245C35C-02E7-46B9-A720-37D3C17AFDD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*", "matchCriteriaId": "F4239A72-EFA1-49E3-8755-5961060F2198", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*", "matchCriteriaId": "C9053CCE-1175-47F9-BF27-7586F082AF83", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.16:*:*:*:*:*:*:*", "matchCriteriaId": "70D3EC47-945C-4B5A-B5B7-C14AE327AC2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.17:*:*:*:*:*:*:*", "matchCriteriaId": "B723AFDD-0A51-43A1-AB0F-A529FF9B7889", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.18:*:*:*:*:*:*:*", "matchCriteriaId": "7D2200BA-FFD0-411E-BFF4-D6C495F57FE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.19:*:*:*:*:*:*:*", "matchCriteriaId": "00550F53-352F-40E5-A6EE-16BE28DD00AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.20:*:*:*:*:*:*:*", "matchCriteriaId": "8D17F903-C184-4B33-97C9-FF4355C2847E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.21:*:*:*:*:*:*:*", "matchCriteriaId": "1E267CF3-397C-4844-91E7-D2550C33D9A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.22:*:*:*:*:*:*:*", "matchCriteriaId": "394519F4-0F58-456E-A999-163992D9A918", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.23:*:*:*:*:*:*:*", "matchCriteriaId": "0C6CCD68-88F1-46D5-AB18-67833E3FF5FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.24:*:*:*:*:*:*:*", "matchCriteriaId": "ACCB8093-D873-4002-A5AE-355277A723CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.25:*:*:*:*:*:*:*", "matchCriteriaId": "8CD61473-1BDD-4540-A86B-D632D015A580", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.26:*:*:*:*:*:*:*", "matchCriteriaId": "D87B8D77-9245-4D7A-97A9-126E22280AC2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.27:*:*:*:*:*:*:*", "matchCriteriaId": "962A6252-DE4A-4F1C-A521-493D8F0893DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.28:*:*:*:*:*:*:*", "matchCriteriaId": "33A3953F-E30A-457A-A70F-CE9880C9B90D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.29:*:*:*:*:*:*:*", "matchCriteriaId": "31E349E2-15A4-4912-AE1E-6A87435820B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.30:*:*:*:*:*:*:*", "matchCriteriaId": "5A2A0AAA-3466-4D26-AD39-1C4F593D9FDF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.31:*:*:*:*:*:*:*", "matchCriteriaId": "046CAC7B-4214-49C5-A386-D1AF240A5DF8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.32:*:*:*:*:*:*:*", "matchCriteriaId": "A880C043-F8FF-4944-9FAC-150BF03121D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.33:*:*:*:*:*:*:*", "matchCriteriaId": "F9A7908B-BA6F-4B4A-848C-D97FF57A252B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.34:*:*:*:*:*:*:*", "matchCriteriaId": "048A0A60-AC69-4817-AD50-63BF81D446D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.35:*:*:*:*:*:*:*", "matchCriteriaId": "4C1361C3-24D6-4697-B9D5-555EB5CF0451", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.36:*:*:*:*:*:*:*", "matchCriteriaId": "A30D4E8D-2293-473E-88B1-FB2C71E46D76", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.37:*:*:*:*:*:*:*", "matchCriteriaId": "A6A910D4-9EC9-4D7E-AE15-C3F4D96321A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.38:*:*:*:*:*:*:*", "matchCriteriaId": "DC3A3FA5-7F1B-4440-A85A-F3E791FE19C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.39:*:*:*:*:*:*:*", "matchCriteriaId": "C0C107D4-6A4F-4CC8-8406-EB18D9BD7DD7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.40:*:*:*:*:*:*:*", "matchCriteriaId": "AA489EF3-71D2-46DD-BB22-7F25688152E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.41:*:*:*:*:*:*:*", "matchCriteriaId": "DF53B9F3-1E1A-4C95-921C-4F9836B89A89", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.42:*:*:*:*:*:*:*", "matchCriteriaId": "3586242F-DCEB-4840-A0D8-E2DD0A6C4E01", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.43:*:*:*:*:*:*:*", "matchCriteriaId": "1CAE6BEA-21B0-434F-B035-B1FDB6331BE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.44:*:*:*:*:*:*:*", "matchCriteriaId": "C44B9431-967F-495A-B36E-AD971369CD90", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.45:*:*:*:*:*:*:*", "matchCriteriaId": "0B27860E-6F36-4C98-B818-CBB8F1697DDA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.46:*:*:*:*:*:*:*", "matchCriteriaId": "9C3D3F12-8F04-45A3-AE22-D874A7B3DE69", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.47:*:*:*:*:*:*:*", "matchCriteriaId": "4720C3C9-3420-4521-A332-BA212A6F6596", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.48:*:*:*:*:*:*:*", "matchCriteriaId": "9642D59E-9AB9-4D53-8833-EBFE1881BEDA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.49:*:*:*:*:*:*:*", "matchCriteriaId": "DEA04289-8940-4B66-AD9A-257D8A1FA0A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.50:*:*:*:*:*:*:*", "matchCriteriaId": "029598EB-C89A-41F6-B4CE-3D9ED838A2D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.51:*:*:*:*:*:*:*", "matchCriteriaId": "10539698-A88B-40D0-B8BC-B4CE2E608AD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.52:*:*:*:*:*:*:*", "matchCriteriaId": "B11E81D7-B260-4CA7-B7C3-DF388B02175F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.53:*:*:*:*:*:*:*", "matchCriteriaId": "CB6D6B17-7FA6-43C0-9FF4-5F649280AD79", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.54:*:*:*:*:*:*:*", "matchCriteriaId": "83AC9644-97E7-47F9-8C6A-7F675B7FFDC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.55:*:*:*:*:*:*:*", "matchCriteriaId": "EB71B43A-F838-47A3-99DB-02B92574678A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.56:*:*:*:*:*:*:*", "matchCriteriaId": "879D56E7-241E-4EB1-ACD4-137E59F862AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.57:*:*:*:*:*:*:*", "matchCriteriaId": "E99BB895-7A73-4326-89B3-77B770F4D1E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*", "matchCriteriaId": "89B129B2-FB6F-4EF9-BF12-E589A87996CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*", "matchCriteriaId": "8B6787B6-54A8-475E-BA1C-AB99334B2535", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*", "matchCriteriaId": "EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*", "matchCriteriaId": "E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*", "matchCriteriaId": "8A6DA0BE-908C-4DA8-A191-A0113235E99A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*", "matchCriteriaId": "39029C72-28B4-46A4-BFF5-EC822CFB2A4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*", "matchCriteriaId": "1A2E05A3-014F-4C4D-81E5-88E725FBD6AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*", "matchCriteriaId": "166C533C-0833-41D5-99B6-17A4FAB3CAF0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*", "matchCriteriaId": "D3768C60-21FA-4B92-B98C-C3A2602D1BC4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*", "matchCriteriaId": "DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*", "matchCriteriaId": "C2409CC7-6A85-4A66-A457-0D62B9895DC1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*", "matchCriteriaId": "B392A7E5-4455-4B1C-8FAC-AE6DDC70689E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*", "matchCriteriaId": "EF411DDA-2601-449A-9046-D250419A0E1A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*", "matchCriteriaId": "D7D8F2F4-AFE2-47EA-A3FD-79B54324DE02", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*", "matchCriteriaId": "1B4FBF97-DE16-4E5E-BE19-471E01818D40", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*", "matchCriteriaId": "3B266B1E-24B5-47EE-A421-E0E3CC0C7471", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*", "matchCriteriaId": "29614C3A-6FB3-41C7-B56E-9CC3F45B04F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*", "matchCriteriaId": "C6AB156C-8FF6-4727-AF75-590D0DCB3F9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*", "matchCriteriaId": "49AAF4DF-F61D-47A8-8788-A21E317A145D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*", "matchCriteriaId": "454211D0-60A2-4661-AECA-4C0121413FEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*", "matchCriteriaId": "0686F977-889F-4960-8E0B-7784B73A7F2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*", "matchCriteriaId": "558703AE-DB5E-4DFF-B497-C36694DD7B24", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*", "matchCriteriaId": "ED6273F2-1165-47A4-8DD7-9E9B2472941B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "A4355F36-B223-4819-8272-751EBB68782F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "E5962DD4-006E-42F3-A0B0-A1787C0E9384", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "6B0D2EE9-1220-4A81-93E6-97FFD3960CFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "2F4ABA66-A344-43F1-98A0-4CD5D8728F0F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "3AC22738-4B74-4EE5-8B13-50D8A4997B37", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "7C2A8AF6-D725-4244-B866-E20F228BBAD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "45978B9B-95B5-47F9-9332-CACCFDFEABD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "6D017BA3-6495-43EC-9670-475081DE3548", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "2EE8A916-AD03-485F-AB4A-FC121A3F8E28", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "7F4FF034-1FA4-4393-8B45-75C32819E10E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "743E0EFB-F2B3-4C9A-AD7E-AB157135DCA3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "0F0377FB-9C66-4CA7-A418-0BBB26BE5CC0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "10D018EE-9780-4976-9461-C2B45F3EF835", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "F4A94099-DEEC-44BE-9CEB-229F69018A42", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "536CD6F1-EA2B-40B1-A179-06C7BD701435", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "FB533E0D-4ABE-4778-B546-90CE2543BB82", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "556FE8EE-C73C-49E4-8E7F-4C033BB1230F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "C4EE9ED2-BA38-4C91-9EC2-02F972335354", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.19:*:*:*:*:*:*:*", "matchCriteriaId": "C3385F07-0D52-494F-BA3E-38D747654363", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.20:*:*:*:*:*:*:*", "matchCriteriaId": "0D13E0C5-7438-4445-A420-1713C0512D53", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.21:*:*:*:*:*:*:*", "matchCriteriaId": "F403DCBB-7E1F-4D61-BE9A-CA61AC2A7CF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.22:*:*:*:*:*:*:*", "matchCriteriaId": "A78D7E11-D5D4-4F41-9220-B2093FEC9A85", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.23:*:*:*:*:*:*:*", "matchCriteriaId": "4D97FF00-EFAF-4663-9653-9A922C7A27CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.24:*:*:*:*:*:*:*", "matchCriteriaId": "C5129FB1-7972-46C1-AFDF-B42E94257750", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.25:*:*:*:*:*:*:*", "matchCriteriaId": "7BF9B8DF-D408-4CC1-98C9-DF19E746A5F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.26:*:*:*:*:*:*:*", "matchCriteriaId": "CC72E8A5-1187-4127-9162-9E003B0043C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.27:*:*:*:*:*:*:*", "matchCriteriaId": "A2DADCAB-DB66-49A8-9932-E004347A87D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.28:*:*:*:*:*:*:*", "matchCriteriaId": "D0533743-6F28-48CB-94B0-F8E1BF023909", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.29:*:*:*:*:*:*:*", "matchCriteriaId": "CED05E4E-FD16-4F3C-A82A-92C94B143986", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "7A20C09D-79FB-4F7C-A56D-D10E76F432C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.31:*:*:*:*:*:*:*", "matchCriteriaId": "74CB0853-920E-4CBC-B2C0-017E769424CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.32:*:*:*:*:*:*:*", "matchCriteriaId": "FC53AE53-D872-4943-85B3-0E5D23A20A68", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.33:*:*:*:*:*:*:*", "matchCriteriaId": "1938D623-92F0-4C4B-9AF7-C822A8ED7D81", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:*", "matchCriteriaId": "66AD3F53-98FA-40B5-9B4F-55F3D6C35B96", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.35:*:*:*:*:*:*:*", "matchCriteriaId": "F0CD6C44-4E62-41FC-8E2F-C02A0CF10D6B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*", "matchCriteriaId": "236DC804-3275-4395-BFAA-260E66AB752B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*", "matchCriteriaId": "41F32E7D-12E8-4EC9-A504-7CA293CC8821", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*", "matchCriteriaId": "90CD7E85-4FF9-4158-AC78-4BFCBC882A65", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*", "matchCriteriaId": "7EA56B52-1015-40CD-B10C-393768094269", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*", "matchCriteriaId": "501B0D4A-D636-4736-979B-D5023599CEFB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*", "matchCriteriaId": "94E7764F-BF9E-463E-B446-A9A8DB92BB97", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*", "matchCriteriaId": "53A9F7EE-AF2A-43E5-B708-0198784AB45A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*", "matchCriteriaId": "AC872C5F-63AF-4BB8-8629-334FC9704AE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*", "matchCriteriaId": "94B95C95-DF3E-49C1-9CA0-4474DD7EF7B8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*", "matchCriteriaId": "82EA4BA7-C38B-4AF3-8914-9E3D089EBDD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*", "matchCriteriaId": "B9C9BC66-FA5F-4774-9BDA-7AB88E2839C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*", "matchCriteriaId": "7F69B9A5-F21B-4904-9F27-95C0F7A628E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "77E39D5C-5EFA-4FEB-909E-0A92004F2563", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources."}, {"lang": "es", "value": "Si un cliente HTTP/2 conectado a Apache Tomcat versiones 10.0.0-M1 hasta 10.0.0-M7, versiones 9.0.0.M1 hasta 9.0.37 o versiones 8.5.0 hasta 8.5.57, excedi\u00f3 el n\u00famero m\u00e1ximo acordado de transmisiones simult\u00e1neas para una conexi\u00f3n (en violaci\u00f3n del protocolo HTTP/2), era posible que una petici\u00f3n subsiguiente realizada en esa conexi\u00f3n pudiera contener encabezados HTTP, incluyendo los pseudo encabezados HTTP/2, de una petici\u00f3n anterior en lugar de los encabezados previstos. Esto podr\u00eda conllevar que los usuarios visualicen respuestas para recursos inesperados"}], "id": "CVE-2020-13943", "lastModified": "2026-10-08T22:16:56.900", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-13943", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T21:06:44.131648Z", "version": "2.0.3"}}]}, "published": "2020-10-12T14:15:12.183", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html"}, {"source": "security@apache.org", "tags": ["Broken Link"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20201016-0007/"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2021/dsa-4835"}, {"source": "security@apache.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20201016-0007/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2021/dsa-4835"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2021:5134", "cpe": "cpe:/a:redhat:jboss_fuse:7", "impact": "low", "package": "tomcat", "product_name": "Red Hat Fuse 7.10", "release_date": "2021-12-14T00:00:00Z"}, {"advisory": "RHSA-2021:0495", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4", "package": "tomcat", "product_name": "Red Hat JBoss Web Server 5", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0494", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7", "package": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws", "product_name": "Red Hat JBoss Web Server 5.4 on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0494", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7", "package": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws", "product_name": "Red Hat JBoss Web Server 5.4 on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0494", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8", "package": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws", "product_name": "Red Hat JBoss Web Server 5.4 on RHEL 8", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0494", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8", "package": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws", "product_name": "Red Hat JBoss Web Server 5.4 on RHEL 8", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:4012", "cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "package": "tomcat", "product_name": "Red Hat Support for Spring Boot 2.4.9", "release_date": "2021-10-28T00:00:00Z"}], "bugzilla": {"description": "tomcat: Apache Tomcat HTTP/2 Request mix-up", "id": "1887648", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887648"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-200", "details": ["If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.", "A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. The highest threat from this vulnerability is to data confidentiality."], "name": "CVE-2020-13943", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:7", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat Decision Manager 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Out of support scope", "package_name": "tomcat5", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "tomcat6", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "pki-deps:10.6/pki-servlet-engine", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:6", "fix_state": "Out of support scope", "package_name": "jbossweb", "product_name": "Red Hat JBoss Data Grid 6"}, {"cpe": "cpe:/a:redhat:jboss_data_virtualization:6", "fix_state": "Out of support scope", "package_name": "jbossweb", "product_name": "Red Hat JBoss Data Virtualization 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Out of support scope", "package_name": "jbossweb", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Out of support scope", "package_name": "tomcat", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat JBoss Web Server 3"}, {"cpe": "cpe:/a:redhat:openstack:10", "fix_state": "Not affected", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 10 (Newton)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-java-common-tomcat", "product_name": "Red Hat Software Collections"}], "public_date": "2020-10-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-13943\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13943\nhttp://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E\nhttp://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8\nhttp://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58\nhttp://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38"], "statement": "Red Hat Enterprise Linux 8's Identity Management is using an affected version of Tomcat bundled within PKI servlet engine, however HTTP/2 protocol is not supported by this component.", "threat_severity": "Moderate"}

{}