CVEvulnerability

CVE-2020-13934

7.5 HIGH Published 2020-07-14 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2020-07-14
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-401, CWE-476

Description

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Affected configurations

• apache tomcat (>= 8.5.1 <= 8.5.56) • apache tomcat (>= 9.0.1 <= 9.0.36) • apache tomcat 9.0.0 • apache tomcat 10.0.0 • debian debian linux 9.0 • debian debian linux 10.0 • netapp oncommand system manager (>= 3.0.0 <= 3.1.3) • opensuse leap 15.1 • opensuse leap 15.2 • canonical ubuntu linux 20.04 • oracle agile engineering data management 6.2.1.0 • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle communications instant messaging server 10.0.1.5.0 • oracle fmw platform 12.2.1.3.0 • oracle fmw platform 12.2.1.4.0 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle instantis enterprisetrack 17.3 • oracle managed file transfer 12.2.1.3.0 • oracle managed file transfer 12.2.1.4.0 • oracle mysql enterprise monitor (<= 8.0.21) • oracle siebel ui framework (<= 20.12) • oracle workload manager 12.2.0.1 • oracle workload manager 18c • oracle workload manager 19c

Related

Weakness · CWE (2)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness
  • CWE-476 NULL Pointer Dereference weakness

References