CVE-2020-13943

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

• apache tomcat 8.5.0 • apache tomcat 8.5.1 • apache tomcat 8.5.2 • apache tomcat 8.5.3 • apache tomcat 8.5.4 • apache tomcat 8.5.5 • apache tomcat 8.5.6 • apache tomcat 8.5.7 • apache tomcat 8.5.8 • apache tomcat 8.5.9 • apache tomcat 8.5.10 • apache tomcat 8.5.11 • apache tomcat 8.5.12 • apache tomcat 8.5.13 • apache tomcat 8.5.14 • apache tomcat 8.5.15 • apache tomcat 8.5.16 • apache tomcat 8.5.17 • apache tomcat 8.5.18 • apache tomcat 8.5.19 • apache tomcat 8.5.20 • apache tomcat 8.5.21 • apache tomcat 8.5.22 • apache tomcat 8.5.23 • apache tomcat 8.5.24 • apache tomcat 8.5.25 • apache tomcat 8.5.26 • apache tomcat 8.5.27 • apache tomcat 8.5.28 • apache tomcat 8.5.29 • apache tomcat 8.5.30 • apache tomcat 8.5.31 • apache tomcat 8.5.32 • apache tomcat 8.5.33 • apache tomcat 8.5.34 • apache tomcat 8.5.35 • apache tomcat 8.5.36 • apache tomcat 8.5.37 • apache tomcat 8.5.38 • apache tomcat 8.5.39 • apache tomcat 8.5.40 • apache tomcat 8.5.41 • apache tomcat 8.5.42 • apache tomcat 8.5.43 • apache tomcat 8.5.44 • apache tomcat 8.5.45 • apache tomcat 8.5.46 • apache tomcat 8.5.47 • apache tomcat 8.5.48 • apache tomcat 8.5.49 • apache tomcat 8.5.50 • apache tomcat 8.5.51 • apache tomcat 8.5.52 • apache tomcat 8.5.53 • apache tomcat 8.5.54 • apache tomcat 8.5.55 • apache tomcat 8.5.56 • apache tomcat 8.5.57 • apache tomcat 9.0.0 • apache tomcat 9.0.1 … and 43 more