CVE-2020-17527
High · 7.5CVSS
7.5
EPSS
24.6%
Published
Dec 3, 2020
CISA due date
—
The record
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat-coyote | 10.0.0-M1 | 10.0.0-M10 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.0 | 8.5.60 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.0-M1 | 9.0.40 |
| Bitnami | tomcat | 8.5.1 | 8.5.59 |
| Bitnami | tomcat | 8.5.1 | 8.5.60 |
| Debian:10 | tomcat9 | 0 | 9.0.31-1~deb10u3 |
| Debian:11 | tomcat9 | 0 | 9.0.40-1 |
| Debian:12 | tomcat9 | 0 | 9.0.40-1 |
| Debian:13 | tomcat9 | 0 | 9.0.40-1 |
| Debian:9 | tomcat8 | 0 | 8.5.54-0+deb9u5 |
| Mageia:7 | tomcat | 0 | 9.0.39-1.mga7 |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-admin-webapps | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-docs-webapp | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-el-3.0-api | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-javadoc | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-jsp-2.3-api | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-lib | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-native | 0 | 0:1.2.25-3.redhat_3.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-native-debuginfo | 0 | 0:1.2.25-3.redhat_3.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-selinux | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-servlet-4.0-api | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el7 | jws5-tomcat-webapps | 0 | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-admin-webapps | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-docs-webapp | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-el-3.0-api | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-javadoc | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-jsp-2.3-api | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-lib | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-native | 0 | 0:1.2.25-3.redhat_3.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-native-debuginfo | 0 | 0:1.2.25-3.redhat_3.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-selinux | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-servlet-4.0-api | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4::el8 | jws5-tomcat-webapps | 0 | 0:9.0.36-9.redhat_8.1.el8jws |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | tomcat | 0 | 9.0.36-3.74.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | tomcat | 0 | 9.0.36-3.74.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | tomcat | 0 | 9.0.36-4.53.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | tomcat | 0 | 9.0.36-3.18.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | tomcat | 0 | 9.0.36-3.58.1 |
| SUSE:Linux Enterprise Server 12 SP5 | tomcat | 0 | 9.0.36-3.58.1 |
| SUSE:Linux Enterprise Server 15-LTSS | tomcat | 0 | 9.0.36-3.74.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | tomcat | 0 | 9.0.36-3.58.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 0 | 9.0.36-3.58.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | tomcat | 0 | 9.0.36-3.74.1 |
| SUSE:OpenStack Cloud 9 | tomcat | 0 | 9.0.36-3.58.1 |
| SUSE:OpenStack Cloud Crowbar 9 | tomcat | 0 | 9.0.36-3.58.1 |
| Ubuntu:18.04:LTS | tomcat9 | 0 | 9.0.16-3ubuntu0.18.04.2 |
| Ubuntu:20.04:LTS | tomcat9 | 0 | 9.0.31-1ubuntu0.2 |
| Ubuntu:Pro:18.04:LTS | tomcat8 | 0 | No fix |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 10.0.0 | No fix |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 8.5.1 | No fix |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 9.0.0 | No fix |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 9.0.35-3.39.1 | No fix |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 9.0.35-3.57.3 | No fix |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 9.0.36 | No fix |
| maven | org.apache.tomcat/tomcat | 10.0.0 | No fix |
| maven | org.apache.tomcat/tomcat | 8.5.1 | No fix |
| maven | org.apache.tomcat/tomcat | 9.0.0 | No fix |
| maven | org.apache.tomcat/tomcat | 9.0.35-3.39.1 | No fix |
| maven | org.apache.tomcat/tomcat | 9.0.35-3.57.3 | No fix |
| maven | org.apache.tomcat/tomcat | 9.0.36 | No fix |
| maven | org.apache.tomcat/tomcat-catalina | 10.0.0 | No fix |
| maven | org.apache.tomcat/tomcat-catalina | 8.5.1 | No fix |
| maven | org.apache.tomcat/tomcat-catalina | 9.0.0 | No fix |
| maven | org.apache.tomcat/tomcat-catalina | 9.0.35-3.39.1 | No fix |
| maven | org.apache.tomcat/tomcat-catalina | 9.0.35-3.57.3 | No fix |
| maven | org.apache.tomcat/tomcat-catalina | 9.0.36 | No fix |
| maven | org.apache.tomcat/tomcat-coyote | 10.0.0 | No fix |
| maven | org.apache.tomcat/tomcat-coyote | 8.5.1 | No fix |
| maven | org.apache.tomcat/tomcat-coyote | 9.0.0 | No fix |
| maven | org.apache.tomcat/tomcat-coyote | 9.0.35-3.39.1 | No fix |
| maven | org.apache.tomcat/tomcat-coyote | 9.0.35-3.57.3 | No fix |
| maven | org.apache.tomcat/tomcat-coyote | 9.0.36 | No fix |
| openSUSE:Leap 15.1 | tomcat | 0 | 9.0.36-lp151.3.39.1 |
| openSUSE:Leap 15.2 | tomcat | 0 | 9.0.36-lp152.2.16.1 |
| openSUSE:Tumbleweed | tomcat | 0 | 9.0.36-8.4 |
| openSUSE:Tumbleweed | tomcat10 | 0 | 10.1.14-1.1 |
Related vulnerabilities
- CVE-2025-48989 Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat… Also affects org.apache.tomcat:tomcat-coyote
- CVE-2025-53506 Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Also affects org.apache.tomcat:tomcat-coyote
- CVE-2025-31650 Apache Tomcat Denial of Service via invalid HTTP priority header Also affects org.apache.tomcat:tomcat-coyote
- CVE-2024-52317 Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect… Also affects org.apache.tomcat:tomcat-coyote
- CVE-2024-34750 Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption… Also affects org.apache.tomcat:tomcat-coyote
- CVE-2024-24549 Denial of Service due to improper input validation vulnerability for HTTP/2 requests in… Also affects org.apache.tomcat:tomcat-coyote
- CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because… Also affects org.apache.tomcat:tomcat-coyote
- CVE-2023-24998 Apache Commons FileUpload before 1.5 does not limit the number of request parts to be… Also affects org.apache.tomcat:tomcat-coyote