CVE-2020-13935

What it actually does

Invalid WebSocket frame payload lengths bypass validation and trigger an infinite loop in the processing thread, consuming CPU and leading to denial of service.

Why it matters to the business

Web applications and services relying on Tomcat can experience sudden unavailability or severe slowdowns when exposed to crafted traffic, affecting user access and backend operations across a wide range of enterprise and cloud deployments.

How an attack unfolds

An attacker identifies a reachable Tomcat instance supporting WebSockets, opens multiple connections, and transmits frames containing invalid payload length values that the server fails to reject, causing the processing loop to run indefinitely until resources are exhausted or the service is restarted.

How to fix it

Upgrade Apache Tomcat to a version that correctly validates WebSocket payload lengths (9.0.37+, 8.5.57+, 7.0.105+ or equivalent 10.0 milestones). Disable WebSocket support if unused. Apply vendor patches for all downstream products such as Oracle and NetApp components.

How to confirm the fix worked

Verify the running Tomcat version against the fixed releases, review server.xml and context configuration for WebSocket usage, and test with a controlled client sending invalid-length frames to confirm loop prevention and stable resource usage.

Typical attack path

1. Scan for publicly reachable Tomcat servers with WebSocket endpoints enabled
2. Establish one or more WebSocket connections to the target
3. Transmit multiple frames with crafted invalid payload length fields
4. Observe sustained high CPU usage and eventual service degradation or crash
5. Repeat or scale the traffic to maintain denial of service

How to detect it

Review Tomcat access and application logs for repeated WebSocket upgrade or frame processing entries accompanied by sustained high CPU on the Java process; correlate with network flow data showing many connections from single sources.

What your security team should do

• Prioritize patching all Tomcat instances given the high and stable EPSS score indicating likely exploitation attempts
• Inventory affected products including Oracle middleware and Debian/Ubuntu packages to scope upgrade windows
• Implement network-level rate limiting or WebSocket connection quotas as a temporary control
• Monitor for anomalous WebSocket traffic volumes until patches are deployed