A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | apache-tomcat-upgrade-8_5_56apache-tomcat-upgrade-9_0_36apache-tomcat-upgrade-10_0_0apache-tomcat-upgrade-latest | Jun 26, 2020 | Jun 26, 2020 | |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 26, 2020 |
| Debian | debian-upgrade-tomcat9 | Jul 14, 2020 | Jun 26, 2020 | |
| Freebsd | freebsd-upgrade-package-tomcat7freebsd-upgrade-package-tomcat85freebsd-upgrade-package-tomcat9freebsd-upgrade-package-tomcat-devel | Jul 24, 2020 | Jul 23, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tomcathuawei-euleros-2_0_sp8-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp8-upgrade-tomcat-el-3.0-apihuawei-euleros-2_0_sp8-upgrade-tomcat-jsp-2.3-apihuawei-euleros-2_0_sp8-upgrade-tomcat-libhuawei-euleros-2_0_sp8-upgrade-tomcat-servlet-4.0-api | Jul 31, 2020 | Jun 26, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-57-11-4-25-0-1-75-1oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-57-11-4-25-0-1-75-1oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-57-11-4-25-0-1-75-1 | Jan 19, 2021 | Jun 26, 2020 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Jun 26, 2020 | |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Jul 4, 2020 | Jun 26, 2020 |
| Ubuntu | ubuntu-upgrade-libtomcat9-embed-javaubuntu-upgrade-libtomcat9-javaubuntu-upgrade-tomcat9ubuntu-upgrade-tomcat9-common | Oct 22, 2020 | Jun 26, 2020 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jun 26, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub