CVE-2020-13934
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
Reported by apache · Published July 14, 2020
tomcat-coyote is fixed in 10.0.0-M6, 9.0.36 and 8.5.56 (Maven Central)
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.apache.tomcat:tomcat-coyote | Maven Central | 10.0.0-M6, 9.0.36, 8.5.56 |
| org.apache.tomcat.embed:tomcat-embed-core | Maven Central | 9.0.36, 8.5.56 |
| tomcat9 | Ubuntu:20.04:LTS | 9.0.31-1ubuntu0.1 |
| tomcat | apache | 9.0.36, 8.5.56 |
| oncommand_system_manager | netapp | 3.1.3 |
| mysql_enterprise_monitor | oracle | 8.0.21 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Tomcat | Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.1, 10.0.0-M1, 9.0.0-M.5 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.0.0, 8.5.1, 9.0.0 |
| n/a | Apache Tomcat | Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56 |
| arch | tomcat9 | 0 |
| Maven | org.apache.tomcat:tomcat | 9.0.0-M.5, 8.5.1, 10.0.0-M1 |
Timeline
- Jul 14, 2020 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Mar 6, 2026 Distribution Patch (20 in total, the first dated here)
- Mar 6, 2026 Security Advisory (27 in total, the first dated here)
- Sep 5, 2026 Coalition ESS Score
- Oct 8, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2020-13934
vulnetix vdb fixes CVE-2020-13934Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-13934/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- DSA-4727 vendor-advisoryx_refsource_DEBIAN
- [debian-lts-announce] 20200722 [SECURITY] [DLA 2286-1] tomcat8 security update mailing-listx_refsource_MLIST
- openSUSE-SU-2020:1102 vendor-advisoryx_refsource_SUSE
- openSUSE-SU-2020:1111 vendor-advisoryx_refsource_SUSE
- [tomcat-dev] 20200818 [Bug 64671] HTTP/2 Stream.receivedData method throwing continuous NullPointerException in the logs mailing-listx_refsource_MLIST
- x_refsource_MISC
- x_refsource_CONFIRM
- USN-4596-1 vendor-advisoryx_refsource_UBUNTU
- x_refsource_MISC
- x_refsource_MISC
- x_refsource_MISC
- x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2020-13934 advisory
- https://github.com/advisories/GHSA-vf77-8h7g-gghp advisory
- https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8@%3Cdev.tomcat.apache.org%3E url
- https://security.netapp.com/advisory/ntap-20200724-0003 advisory
- https://usn.ubuntu.com/4596-1 url