An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | amazon-linux-upgrade-tomcat8 | Jul 30, 2020 | Jul 14, 2020 |
| Apache Tomcat | apache-tomcat-upgrade-8_5_57apache-tomcat-upgrade-9_0_37apache-tomcat-upgrade-10_0_0apache-tomcat-upgrade-latest | Jul 16, 2020 | Jul 14, 2020 | |
| Debian | debian-upgrade-tomcat9 | Jul 21, 2020 | Jul 14, 2020 | |
| Freebsd | freebsd-upgrade-package-tomcat7freebsd-upgrade-package-tomcat85freebsd-upgrade-package-tomcat9freebsd-upgrade-package-tomcat-devel | Jul 24, 2020 | Jul 23, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tomcathuawei-euleros-2_0_sp8-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp8-upgrade-tomcat-el-3.0-apihuawei-euleros-2_0_sp8-upgrade-tomcat-jsp-2.3-apihuawei-euleros-2_0_sp8-upgrade-tomcat-libhuawei-euleros-2_0_sp8-upgrade-tomcat-servlet-4.0-api | Jul 31, 2020 | Jul 14, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-57-11-4-25-0-1-75-1oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-57-11-4-25-0-1-75-1oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-57-11-4-25-0-1-75-1 | Jan 19, 2021 | Jul 14, 2020 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Jul 14, 2020 | |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Jul 25, 2020 | Jul 14, 2020 |
| Ubuntu | ubuntu-upgrade-libtomcat9-embed-javaubuntu-upgrade-libtomcat9-javaubuntu-upgrade-tomcat9ubuntu-upgrade-tomcat9-common | Oct 22, 2020 | Jul 14, 2020 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub