Uncontrolled resource consumption in Apache Tomcat
Priority MEDIUM 61CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.26699 98th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.0.0-M5, 9.0.35, 8.5.55org.apache.tomcat.embed:tomcat-embed-core (Maven): 10.0.0-M5, 9.0.35, 8.5.55Red Hat: 5 advisoriesRed Hat: 7 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 10.0.0-M1 to 10.0.0-M5; 9.0.0.M1 to 9.0.35; 8.5.0 to 8.5.55 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 10.0.0-M1 to before 10.0.0-M5 | 10.0.0-M5 | Patch available | GHSA-53hp-jpwq-2jgq |
| — | org.apache.tomcat:tomcat (Maven) | 9.0.0.M1 to before 9.0.35 | 9.0.35 | Patch available | GHSA-53hp-jpwq-2jgq |
| — | org.apache.tomcat:tomcat (Maven) | 8.5.0 to before 8.5.55 | 8.5.55 | Patch available | GHSA-53hp-jpwq-2jgq |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 10.0.0-M1 to before 10.0.0-M5 | 10.0.0-M5 | Patch available | GHSA-53hp-jpwq-2jgq |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0.M1 to before 9.0.35 | 9.0.35 | Patch available | GHSA-53hp-jpwq-2jgq |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.5.0 to before 8.5.55 | 8.5.55 | Patch available | GHSA-53hp-jpwq-2jgq |
- Apache Tomcat VendorApache Affected 10.0.0-M1 to 10.0.0-M5; 9.0.0.M1 to 9.0.35; 8.5.0 to 8.5.55 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M5 Fixed in 10.0.0-M5 Patch available GHSA-53hp-jpwq-2jgq
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.35 Fixed in 9.0.35 Patch available GHSA-53hp-jpwq-2jgq
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.0 to before 8.5.55 Fixed in 8.5.55 Patch available GHSA-53hp-jpwq-2jgq
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M5 Fixed in 10.0.0-M5 Patch available GHSA-53hp-jpwq-2jgq
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.35 Fixed in 9.0.35 Patch available GHSA-53hp-jpwq-2jgq
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.0 to before 8.5.55 Fixed in 8.5.55 Patch available GHSA-53hp-jpwq-2jgq
CPE configurations NVD · 45
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 8.5.0 – 8.5.55; 9.0.0 – 9.0.35 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* | 9.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* | 9.0.0 milestone16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* | 9.0.0 milestone17 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.0 – 8.5.55; 9.0.0 – 9.0.35 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
Show 35 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* | 9.0.0 milestone18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* | 9.0.0 milestone19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* | 9.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* | 9.0.0 milestone20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* | 9.0.0 milestone21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* | 9.0.0 milestone22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* | 9.0.0 milestone23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* | 9.0.0 milestone24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* | 9.0.0 milestone25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* | 9.0.0 milestone26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* | 9.0.0 milestone27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* | 9.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* | 9.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* | 10.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* | 10.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* | 10.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* | 10.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* | 10.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 8.0.21 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* | up to 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* | 12.2.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* | 19c | Vulnerable | Oracle |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:oncommand_system_manager:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_system_manager:3.1.3:*:*:*:*:*:*:* | 3.1.3 | Vulnerable | NetApp |
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* Versions 10.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* Versions 10.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* Versions 10.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* Versions 10.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* Versions 10.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.21 Vulnerable ·Oracle
- cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:oncommand_system_manager:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_system_manager:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·NetApp
Remediation
- Fix · GHSA-53hp-jpwq-2jgq org.apache.tomcat:tomcat (Maven) Fixed in 10.0.0-M5 Advisory →
- Fix · GHSA-53hp-jpwq-2jgq org.apache.tomcat:tomcat (Maven) Fixed in 9.0.35 Advisory →
- Fix · GHSA-53hp-jpwq-2jgq org.apache.tomcat:tomcat (Maven) Fixed in 8.5.55 Advisory →
- Fix · GHSA-53hp-jpwq-2jgq org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.0.0-M5 Advisory →
- Fix · GHSA-53hp-jpwq-2jgq org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.35 Advisory →
- Fix · GHSA-53hp-jpwq-2jgq org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.55 Advisory →
Red Hat 5 advisories
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
- RHSA-2021:0292 Released 2021-02-02 · Red Hat rating ImportantRed Hat support for Spring Boot 2.3.6 security update
- Red Hat support for Spring Boot 2.3.6
- RHSA-2020:5388 Released 2021-01-07 · Red Hat rating ImportantRed Hat support for Spring Boot 2.2.11 security update
- Text-Only RHOAR
Show 2 more Red Hat advisories
- RHSA-2020:5170 Released 2020-11-23 · Red Hat rating ModerateRed Hat JBoss Web Server 5.4 security release
- Red Hat JBoss Web Server 5.4 for RHEL 6 Server jws5-jboss-logging-3.4.1-1.Final_redhat_00001.1.el6jws, jws5-mod_cluster-1.4.2-7.Final_redhat_00002.2.el6jws, jws5-mod_cluster-tomcat-1.4.2-7.Final_redhat_00002.2.el6jws +11
- Red Hat JBoss Web Server 5.4 for RHEL 7 Server jws5-jboss-logging-3.4.1-1.Final_redhat_00001.1.el7jws, jws5-mod_cluster-1.4.2-7.Final_redhat_00002.2.el7jws, jws5-mod_cluster-tomcat-1.4.2-7.Final_redhat_00002.2.el7jws +11
- Red Hat JBoss Web Server 5.4 for RHEL 8 jws5-jboss-logging-3.4.1-1.Final_redhat_00001.1.el8jws, jws5-mod_cluster-1.4.2-7.Final_redhat_00002.2.el8jws, jws5-mod_cluster-tomcat-1.4.2-7.Final_redhat_00002.2.el8jws +11
- RHSA-2020:5173 Released 2020-11-23 · Red Hat rating ModerateRed Hat JBoss Web Server 5.4 security release
- Red Hat JBoss Web Server 5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
| Red Hat JBoss Web Server 5 | Fixed | RHSA-2020:5173 |
| Red Hat JBoss Web Server 5.4 for RHEL 6 Server | Fixed | RHSA-2020:5170 |
| Red Hat JBoss Web Server 5.4 for RHEL 7 Server | Fixed | RHSA-2020:5170 |
| Red Hat JBoss Web Server 5.4 for RHEL 8 | Fixed | RHSA-2020:5170 |
| Red Hat support for Spring Boot 2.3.6 | Fixed | RHSA-2021:0292 |
| Text-Only RHOAR | Fixed | RHSA-2020:5388 |
Not affected: 5 products
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss Web Server 3
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11996
- 2026-10-03 Alias added: GHSA-53hp-jpwq-2jgq
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 10
- https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E
- [debian-lts-announce] 20200712 [SECURITY] [DLA 2279-1] tomcat8 security update
- DSA-4727
- openSUSE-SU-2020:1051
- openSUSE-SU-2020:1063
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20200709-0002/
- USN-4596-1
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-11996
Other 39
- [ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-notifications] 20200628 [jira] [Closed] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11848) Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-commits] 20200628 [ofbiz-framework] branch release18.12 updated: Fixed: Upgrades Tomcat to 9.0.36 due to CVE-2020-11996 (OFBIZ-11848)
- [ofbiz-notifications] 20200628 [jira] [Closed] (OFBIZ-11848) Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-notifications] 20200628 [jira] [Commented] (OFBIZ-11848) Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-commits] 20200628 [ofbiz-framework] branch release17.12 updated: Fixed: Upgrades Tomcat to 9.0.36 due to CVE-2020-11996 (OFBIZ-11848)
- [ofbiz-commits] 20200628 [ofbiz-framework] branch trunk updated: Fixed: Upgrades Tomcat to 9.0.36 due to CVE-2020-11996 (OFBIZ-11848)
- [ofbiz-notifications] 20200701 [jira] [Reopened] (OFBIZ-11848) Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-notifications] 20200703 [jira] [Comment Edited] (OFBIZ-11848) Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-notifications] 20200703 [jira] [Closed] (OFBIZ-11848) Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [ofbiz-notifications] 20200703 [jira] [Commented] (OFBIZ-11848) Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- [tomcat-users] 20201008 Is Tomcat7 supports HTTP2
- [ofbiz-notifications] 20210301 [jira] [Updated] (OFBIZ-11848) Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
- https://github.com/apache/tomcat/commit/9434a44d3449d620b1be70206819f8275b4a7509
- https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b0c976
- https://github.com/apache/tomcat/commit/c8acd2ab7371e39aeca7c306f3b5380f00afe552
- https://lists.apache.org/thread.html/rb820f1a2a02bf07414be12c653c2ab5321fd87b9bf6c5e635c53ff4b@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rc80b96b4b96618b2b7461cb90664a428cfd6605eea9f74e51b792542@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rea65d6ef2e45dd1c45faae83922042732866c7b88fa109b76c83db52@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/ref0339792ac6dac1dba83c071a727ad72380899bde60f6aaad4031b9@%3Cnotifications.ofbiz.apache.org%3E
- https://security.netapp.com/advisory/ntap-20200709-0002
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-9.html
- https://usn.ubuntu.com/4596-1
- https://lists.apache.org/thread.html/rb4ee49ecc4c59620ffd5e66e84a17e526c2c3cfa95d0cd682d90d338@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r9ad911fe49450ed9405827af0e7a74104041081ff91864b1f2546bbd@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r93ca628ef3a4530dfe5ac49fddc795f0920a4b2a408b57a30926a42b@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff1057115008100561@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r74f5a8204efe574cbfcd95b2a16236fe95beb45c4d9fee3dc789dca9@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r6c29801370a36c1a5159679269777ad0c73276d3015b8bbefea66e5c@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r5a4f80a6acc6607d61dae424b643b594c6188dd4e1eff04705c10db2@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd@%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79@%3Cusers.tomcat.apache.org%3E
- https://github.com/apache/tomcat
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2020-11996 · CVE Program
- CVE-2020-11996 · NVD
- FIRST EPSS
- GHSA-53hp-jpwq-2jgq · GitHub Advisory Database · CC BY 4.0
- CVE-2020-11996 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences