CVE-2020-11996

Published: Jun 26, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Affected (46)

Products: Apache: Tomcat · Canonical: Ubuntu Linux · Oracle: Mysql Enterprise Monitor, Siebel Ui Framework, Workload Manager · +3 more

Show all products

Apache: Tomcat · Canonical: Ubuntu Linux · Oracle: Mysql Enterprise Monitor, Siebel Ui Framework, Workload Manager · Opensuse: Leap · Debian: Debian Linux · Netapp: Oncommand System Manager

1 product

1 product

3 products

Mysql Enterprise Monitor

1 product

1 product

1 product

Oncommand System Manager

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 8.5.0 to 8.5.55
Apache Tomcat	From 9.0.0 to 9.0.35
Apache Tomcat	Version 10.0.0 milestone1
Apache Tomcat	Version 10.0.0 milestone2
Apache Tomcat	Version 10.0.0 milestone3
Apache Tomcat	Version 10.0.0 milestone4
Apache Tomcat	Version 10.0.0 milestone5
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone1
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone22
Apache Tomcat	Version 9.0.0 milestone23
Apache Tomcat	Version 9.0.0 milestone24
Apache Tomcat	Version 9.0.0 milestone25
Apache Tomcat	Version 9.0.0 milestone26
Apache Tomcat	Version 9.0.0 milestone27
Apache Tomcat	Version 9.0.0 milestone2
Apache Tomcat	Version 9.0.0 milestone3
Apache Tomcat	Version 9.0.0 milestone4
Apache Tomcat	Version 9.0.0 milestone5
Apache Tomcat	Version 9.0.0 milestone6
Apache Tomcat	Version 9.0.0 milestone7
Apache Tomcat	Version 9.0.0 milestone8
Apache Tomcat	Version 9.0.0 milestone9

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 20.04

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Mysql Enterprise Monitor	Up to 8.0.21
Oracle Siebel Ui Framework	Up to 20.12
Oracle Workload Manager	Version 12.2.0.1
Oracle Workload Manager	Version 18c
Oracle Workload Manager	Version 19c

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand System Manager	Version 3.0
Netapp Oncommand System Manager	Version 3.1.3

References (48)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html

Source: security@apache.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r5a4f80a6acc6607d61dae424b643b594c6188dd4e1eff04705c10db2%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6c29801370a36c1a5159679269777ad0c73276d3015b8bbefea66e5c%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r74f5a8204efe574cbfcd95b2a16236fe95beb45c4d9fee3dc789dca9%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff1057115008100561%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r93ca628ef3a4530dfe5ac49fddc795f0920a4b2a408b57a30926a42b%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9ad911fe49450ed9405827af0e7a74104041081ff91864b1f2546bbd%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rb4ee49ecc4c59620ffd5e66e84a17e526c2c3cfa95d0cd682d90d338%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rb820f1a2a02bf07414be12c653c2ab5321fd87b9bf6c5e635c53ff4b%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rc80b96b4b96618b2b7461cb90664a428cfd6605eea9f74e51b792542%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rea65d6ef2e45dd1c45faae83922042732866c7b88fa109b76c83db52%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/ref0339792ac6dac1dba83c071a727ad72380899bde60f6aaad4031b9%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20200709-0002/

Source: security@apache.org

Third Party Advisory

https://usn.ubuntu.com/4596-1/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4727

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: security@apache.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html