CVE-2020-11996

tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Una secuencia especialmente diseñada de peticiones HTTP/2 enviadas a Apache Tomcat versiones 10.0.0-M1 hasta 10.0.0-M5, versiones 9.0.0.M1 hasta 9.0.35 y versiones 8.5.0 hasta 8.5.55, podría desencadenar un uso elevado de la CPU por varios segundos. Si se hacen una cantidad suficiente de tales peticiones en conexiones HTTP/2 concurrentes, el servidor podría dejar de responder

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector, the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 5.4 serves as a replacement for Red Hat JBoss Web Server 5.3, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References. Issues addressed include a denial of service vulnerability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-04-21 CVE Reserved
2020-06-26 CVE Published
2020-11-06 First Exploit
2024-08-04 CVE Updated
2025-05-04 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (27)

URL	Tag	Source
https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79%40%3Cusers.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r5a4f80a6acc6607d61dae424b643b594c6188dd4e1eff04705c10db2%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r6c29801370a36c1a5159679269777ad0c73276d3015b8bbefea66e5c%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r74f5a8204efe574cbfcd95b2a16236fe95beb45c4d9fee3dc789dca9%40%3Ccommits.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff1057115008100561%40%3Ccommits.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r93ca628ef3a4530dfe5ac49fddc795f0920a4b2a408b57a30926a42b%40%3Ccommits.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r9ad911fe49450ed9405827af0e7a74104041081ff91864b1f2546bbd%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rb4ee49ecc4c59620ffd5e66e84a17e526c2c3cfa95d0cd682d90d338%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rb820f1a2a02bf07414be12c653c2ab5321fd87b9bf6c5e635c53ff4b%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rc80b96b4b96618b2b7461cb90664a428cfd6605eea9f74e51b792542%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rea65d6ef2e45dd1c45faae83922042732866c7b88fa109b76c83db52%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/ref0339792ac6dac1dba83c071a727ad72380899bde60f6aaad4031b9%40%3Cnotifications.ofbiz.apache.org%3E	Mailing List
https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html	Mailing List
https://security.netapp.com/advisory/ntap-20200709-0002	Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	Third Party Advisory

URL	Date	SRC
https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996	2020-11-06

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.html	2023-11-07
https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E	2023-11-07
https://usn.ubuntu.com/4596-1	2023-11-07
https://www.debian.org/security/2020/dsa-4727	2023-11-07
https://access.redhat.com/security/cve/CVE-2020-11996	2021-08-11
https://bugzilla.redhat.com/show_bug.cgi?id=1851420	2021-08-11

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 8.5.0 <= 8.5.55 Search vendor "Apache" for product "Tomcat" and version " >= 8.5.0 <= 8.5.55"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 9.0.0 <= 9.0.35 Search vendor "Apache" for product "Tomcat" and version " >= 9.0.0 <= 9.0.35"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone1		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone10		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone11		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone12		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone13		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone14		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone15		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone16		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone17		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone18		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone19		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone2		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone20		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone21		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone22		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone23		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone24		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone25		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone26		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone27		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone3		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone4		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone5		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone6		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone7		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone8		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone9		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone1		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone2		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone3		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone4		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone5		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				20.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "20.04"		lts		Affected
Oracle Search vendor "Oracle"		Mysql Enterprise Monitor Search vendor "Oracle" for product "Mysql Enterprise Monitor"				<= 8.0.21 Search vendor "Oracle" for product "Mysql Enterprise Monitor" and version " <= 8.0.21"		-		Affected
Oracle Search vendor "Oracle"		Siebel Ui Framework Search vendor "Oracle" for product "Siebel Ui Framework"				<= 20.12 Search vendor "Oracle" for product "Siebel Ui Framework" and version " <= 20.12"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				12.2.0.1 Search vendor "Oracle" for product "Workload Manager" and version "12.2.0.1"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				18c Search vendor "Oracle" for product "Workload Manager" and version "18c"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				19c Search vendor "Oracle" for product "Workload Manager" and version "19c"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.1 Search vendor "Opensuse" for product "Leap" and version "15.1"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.2 Search vendor "Opensuse" for product "Leap" and version "15.2"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Netapp Search vendor "Netapp"		Oncommand System Manager Search vendor "Netapp" for product "Oncommand System Manager"				3.0 Search vendor "Netapp" for product "Oncommand System Manager" and version "3.0"		-		Affected
Netapp Search vendor "Netapp"		Oncommand System Manager Search vendor "Netapp" for product "Oncommand System Manager"				3.1.3 Search vendor "Netapp" for product "Oncommand System Manager" and version "3.1.3"		-		Affected