← Back

CVE-2020-13934

nvd nist
Published: Jul 14, 2020Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Affected (54)

Show all products
Apache: Tomcat · Debian: Debian Linux · Netapp: Oncommand System Manager · Opensuse: Leap · Canonical: Ubuntu Linux · Oracle: Agile Engineering Data Management, Agile Plm, Communications Instant Messaging Server, Fmw Platform, Instantis Enterprisetrack, Managed File Transfer, Mysql Enterprise Monitor, Siebel Ui Framework, Workload Manager
Apache
1 product
Tomcat
Debian
1 product
Debian Linux
Netapp
1 product
Oncommand System Manager
Opensuse
1 product
Leap
Canonical
1 product
Ubuntu Linux
Oracle
9 products
Agile Engineering Data Management
Agile Plm
Communications Instant Messaging Server
Fmw Platform
Instantis Enterprisetrack
Managed File Transfer
Mysql Enterprise Monitor
Siebel Ui Framework
Workload Manager
Configuration A
31 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Tomcat
From 8.5.1 to 8.5.56
Tomcat
From 9.0.1 to 9.0.36
Tomcat
Version 10.0.0 milestone1
Tomcat
Version 10.0.0 milestone2
Tomcat
Version 10.0.0 milestone3
Tomcat
Version 10.0.0 milestone4
Tomcat
Version 10.0.0 milestone5
Tomcat
Version 10.0.0 milestone6
Tomcat
Version 9.0.0 milestone10
Tomcat
Version 9.0.0 milestone11
Tomcat
Version 9.0.0 milestone12
Tomcat
Version 9.0.0 milestone13
Tomcat
Version 9.0.0 milestone14
Tomcat
Version 9.0.0 milestone15
Tomcat
Version 9.0.0 milestone16
Tomcat
Version 9.0.0 milestone17
Tomcat
Version 9.0.0 milestone18
Tomcat
Version 9.0.0 milestone19
Tomcat
Version 9.0.0 milestone20
Tomcat
Version 9.0.0 milestone21
Tomcat
Version 9.0.0 milestone22
Tomcat
Version 9.0.0 milestone23
Tomcat
Version 9.0.0 milestone24
Tomcat
Version 9.0.0 milestone25
Tomcat
Version 9.0.0 milestone26
Tomcat
Version 9.0.0 milestone27
Tomcat
Version 9.0.0 milestone5
Tomcat
Version 9.0.0 milestone6
Tomcat
Version 9.0.0 milestone7
Tomcat
Version 9.0.0 milestone8
Tomcat
Version 9.0.0 milestone9
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 9.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Oncommand System Manager
From 3.0.0 to 3.1.3
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Opensuse
Leap
Version 15.1
Leap
Version 15.2
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Ubuntu Linux
Version 20.04
Configuration F
17 vulnerable
Vulnerable SoftwareAffected Versions
Agile Engineering Data Management
Version 6.2.1.0
Oracle
Agile Plm
Version 9.3.3
Agile Plm
Version 9.3.5
Agile Plm
Version 9.3.6
Communications Instant Messaging Server
Version 10.0.1.5.0
Oracle
Fmw Platform
Version 12.2.1.3.0
Fmw Platform
Version 12.2.1.4.0
Oracle
Instantis Enterprisetrack
Version 17.1
Instantis Enterprisetrack
Version 17.2
Instantis Enterprisetrack
Version 17.3
Oracle
Managed File Transfer
Version 12.2.1.3.0
Managed File Transfer
Version 12.2.1.4.0
Mysql Enterprise Monitor
Up to 8.0.21
Siebel Ui Framework
Up to 20.12
Oracle
Workload Manager
Version 12.2.0.1
Workload Manager
Version 18c
Workload Manager
Version 19c

Related CWEs

CWE-401
Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CWE-476
NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.

References (26)

Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Mailing ListRelease NotesVendor Advisory
Source: security@apache.org
Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListRelease NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.