CVE-2020-13934

7.5 highEPSS 64%

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

CVSS 3.1: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 64% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)
CWEs: CWE-401, CWE-476
Published: 2020-07-14
Modified: 2026-10-08
Record from: the NVD, synced 2026-10-19

Affected

apache:tomcat
canonical:ubuntu_linux
debian:debian_linux
netapp:oncommand_system_manager
opensuse:leap
oracle:agile_engineering_data_management
oracle:agile_product_lifecycle_management
oracle:communications_instant_messaging_server
oracle:fmw_platform
oracle:instantis_enterprisetrack
oracle:managed_file_transfer
oracle:mysql_enterprise_monitor
oracle:siebel_ui_framework
oracle:workload_manager

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-vf77-8h7g-gghp	Maven	org.apache.tomcat:tomcat	>=10.0.0-M1 <10.0.0-M6	10.0.0-M6
GHSA-vf77-8h7g-gghp	Maven	org.apache.tomcat:tomcat	>=9.0.0.M5 <9.0.36	9.0.36
GHSA-vf77-8h7g-gghp	Maven	org.apache.tomcat:tomcat	>=8.5.1 <8.5.56	8.5.56
GHSA-vf77-8h7g-gghp	Maven	org.apache.tomcat:tomcat-coyote	>=10.0.0-M1 <10.0.0-M6	10.0.0-M6
GHSA-vf77-8h7g-gghp	Maven	org.apache.tomcat:tomcat-coyote	>=9.0.0.M5 <9.0.36	9.0.36
GHSA-vf77-8h7g-gghp	Maven	org.apache.tomcat:tomcat-coyote	>=8.5.1 <8.5.56	8.5.56

References

Check your stack JSON