vulnerability
Apache Tomcat: Important: WebSocket DoS (CVE-2020-13935)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:N/A:P) | Jul 14, 2020 | Jul 16, 2020 | Jun 19, 2026 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Published
Jul 14, 2020
Added
Jul 16, 2020
Modified
Jun 19, 2026
Description
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Solutions
apache-tomcat-upgrade-7_0_105apache-tomcat-upgrade-8_5_57apache-tomcat-upgrade-9_0_37apache-tomcat-upgrade-10_0_0apache-tomcat-10_0apache-tomcat-7_0apache-tomcat-8_5apache-tomcat-9_0apache-tomcat-upgrade-latest
References
- CVE-2020-13935
- https://attackerkb.com/topics/CVE-2020-13935
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-7.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-9.html
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1098
- CWE-835
- EUVD-EUVD-2022-1098
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.