The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-javadocUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-api | May 17, 2023 | Jul 14, 2020 |
| Amazon_linux | — | Upgrade tomcat8 | Jul 30, 2020 | Jul 14, 2020 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.37Upgrade Apache Tomcat to 7.0.105Upgrade Apache Tomcat to 10.0.0Upgrade Apache Tomcat to 8.5.57 | Jul 16, 2020 | Jul 14, 2020 |
| Centos_linux | — | Upgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webapp | Oct 1, 2020 | Jul 14, 2020 |
| Debian | — | Upgrade tomcat9 | Jul 21, 2020 | Jul 14, 2020 |
| Freebsd | — | Upgrade tomcat9Upgrade tomcat7Upgrade tomcat-develUpgrade tomcat85 | Jul 24, 2020 | Jul 23, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-libUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webapps | Nov 3, 2020 | Jul 14, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-webapps | Sep 28, 2020 | Jul 14, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-api | Nov 2, 2020 | Jul 14, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-api | Jul 31, 2020 | Jul 14, 2020 |
| Oracle Missing Cpu Oct 2020 | — | Apply the October 2020 Critical Patch Update (CPU) for Oracle Database | Oct 22, 2020 | Jul 14, 2020 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.57-11.4.25.0.1.75.1 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.57-11.4.25.0.1.75.1 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.57-11.4.25.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Jul 14, 2020 |
| Oracle_linux | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-javadoc | Oct 7, 2020 | Jul 15, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jul 15, 2020 |
| Redhat_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcNo solution existsUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-docs-webapp | Oct 1, 2020 | Jul 14, 2020 |
| Suse | — | Upgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-embedUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-javadocUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-api | Jul 26, 2020 | Jul 14, 2020 |
| Ubuntu | — | Upgrade tomcat9Upgrade libtomcat9-javaUpgrade tomcat9-commonUpgrade libtomcat8-javaUpgrade libtomcat9-embed-javaUpgrade tomcat8 | Aug 5, 2020 | Jul 14, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub