High severity · published Jun 26, 2020
CVE-2020-11996
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several…
7.5
CVSS
26.7%
EPSS
No
On KEV
Description
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)26.7% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
10.0.0-M1 to 10.0.0-M5; 9.0.0.M1 to 9.0.35; 8.5.0 to 8.5.55 · source: vendor, NVD
DL
Debian Linux · Debian
9.0; 10.0 · source: NVD
LE
Leap · Opensuse
15.1; 15.2 · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 8.0.21 · source: NVD
OS
Oncommand System Manager · Netapp
3.0; 3.1.3 · source: NVD
SU
Siebel UI Framework · Oracle
through 20.12 · source: NVD
UL
Ubuntu Linux · Canonical
20.04 · source: NVD
WM
Workload Manager · Oracle
12.2.0.1; 18c; 19c · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11996
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11996
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.html
lists.apache.org
https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79%40%3Cusers.tomcat.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd%40%3Cnotifications.ofbiz.apache.org%3E
Mailing List
https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r5a4f80a6acc6607d61dae424b643b594c6188dd4e1eff04705c10db2%40%3Cnotifications.ofbiz.apache.org%3E
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g