CVE-2020-11996 PUBLISHED

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0 to 10.0.0, 9.0.0 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

EPSS 45.12% · 97.6th percentile

Risk Scores

EPSS Score
45.12%
97.6th percentile

Affected Products

VendorProductVersions
Bitnamitomcat9.0.0, 9.0.0, 8.5.0
Bitnamitomcat9.0.0, 8.5.0

Timeline

References

…and 5 more

Open in Interactive Console →