Read the docs
TI-2020-10911 Aliases CVE-2020-13934GHSA-vf77-8h7g-gghp

Memory leak in Apache Tomcat

Priority HIGH 74CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-401.

Summary

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.64124 99th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.0.0-M6, 9.0.36, 8.5.56org.apache.tomcat:tomcat-coyote (Maven): 10.0.0-M6, 9.0.36, 8.5.56Red Hat: 4 advisoriesRed Hat: 6 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache TomcatApache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)10.0.0-M1 to before 10.0.0-M610.0.0-M6Patch availableGHSA-vf77-8h7g-gghp
—org.apache.tomcat:tomcat (Maven)9.0.0.M5 to before 9.0.369.0.36Patch availableGHSA-vf77-8h7g-gghp
—org.apache.tomcat:tomcat (Maven)8.5.1 to before 8.5.568.5.56Patch availableGHSA-vf77-8h7g-gghp
—org.apache.tomcat:tomcat-coyote (Maven)10.0.0-M1 to before 10.0.0-M610.0.0-M6Patch availableGHSA-vf77-8h7g-gghp
—org.apache.tomcat:tomcat-coyote (Maven)9.0.0.M5 to before 9.0.369.0.36Patch availableGHSA-vf77-8h7g-gghp
—org.apache.tomcat:tomcat-coyote (Maven)8.5.1 to before 8.5.568.5.56Patch availableGHSA-vf77-8h7g-gghp
  • Apache Tomcat Vendor— Affected Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M6 Fixed in 10.0.0-M6 Patch available GHSA-vf77-8h7g-gghp
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0.M5 to before 9.0.36 Fixed in 9.0.36 Patch available GHSA-vf77-8h7g-gghp
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.1 to before 8.5.56 Fixed in 8.5.56 Patch available GHSA-vf77-8h7g-gghp
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M6 Fixed in 10.0.0-M6 Patch available GHSA-vf77-8h7g-gghp
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 9.0.0.M5 to before 9.0.36 Fixed in 9.0.36 Patch available GHSA-vf77-8h7g-gghp
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.5.1 to before 8.5.56 Fixed in 8.5.56 Patch available GHSA-vf77-8h7g-gghp

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*8.5.1 – 8.5.56; 9.0.1 – 9.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*9.0.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*9.0.0 milestone11VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*9.0.0 milestone12VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*9.0.0 milestone13VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*9.0.0 milestone14VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*9.0.0 milestone15VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*9.0.0 milestone16VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*9.0.0 milestone17VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*9.0.0 milestone18VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.1 – 8.5.56; 9.0.1 – 9.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*9.0.0 milestone19VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*9.0.0 milestone20VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*9.0.0 milestone21VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*9.0.0 milestone22VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*9.0.0 milestone23VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*9.0.0 milestone24VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*9.0.0 milestone25VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*9.0.0 milestone26VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*9.0.0 milestone27VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*9.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*9.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*9.0.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*9.0.0 milestone8VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*9.0.0 milestone9VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*10.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*10.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*10.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*10.0.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*10.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*10.0.0 milestone6VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*3.0.0 – 3.1.3VulnerableNetApp
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*9.3.3VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*9.3.5VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*10.0.1.5.0VulnerableOracle
cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*17.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*17.3VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 8.0.21VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 20.12VulnerableOracle
cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*19cVulnerableOracle
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* Versions 10.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* Versions 10.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* Versions 10.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* Versions 10.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* Versions 10.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:* Versions 10.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.1.3 Vulnerable ·NetApp
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.21 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle

Remediation

  • Fix · GHSA-vf77-8h7g-gghp org.apache.tomcat:tomcat (Maven) Fixed in 10.0.0-M6 Advisory →
  • Fix · GHSA-vf77-8h7g-gghp org.apache.tomcat:tomcat (Maven) Fixed in 9.0.36 Advisory →
  • Fix · GHSA-vf77-8h7g-gghp org.apache.tomcat:tomcat (Maven) Fixed in 8.5.56 Advisory →
  • Fix · GHSA-vf77-8h7g-gghp org.apache.tomcat:tomcat-coyote (Maven) Fixed in 10.0.0-M6 Advisory →
  • Fix · GHSA-vf77-8h7g-gghp org.apache.tomcat:tomcat-coyote (Maven) Fixed in 9.0.36 Advisory →
  • Fix · GHSA-vf77-8h7g-gghp org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.5.56 Advisory →

Red Hat 4 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:3806 Released 2020-09-23 · Red Hat rating Important
    Red Hat support for Spring Boot 2.2.6.SP2 security update
    • Red Hat Runtimes Spring Boot 2.2.6
  • RHSA-2020:3308 Released 2020-08-04 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3.2 security update
    • Red Hat JBoss Web Server (JWS) 5.3
Show 1 more Red Hat advisories
  • RHSA-2020:3306 Released 2020-08-04 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3.2 security update
    • Red Hat JBoss Web Server 5.3 for RHEL 6 Server jws5-tomcat-9.0.30-5.redhat_6.1.el6jws, jws5-tomcat-admin-webapps-9.0.30-5.redhat_6.1.el6jws, jws5-tomcat-docs-webapp-9.0.30-5.redhat_6.1.el6jws +7
    • Red Hat JBoss Web Server 5.3 for RHEL 7 Server jws5-tomcat-9.0.30-5.redhat_6.1.el7jws, jws5-tomcat-admin-webapps-9.0.30-5.redhat_6.1.el7jws, jws5-tomcat-docs-webapp-9.0.30-5.redhat_6.1.el7jws +7
    • Red Hat JBoss Web Server 5.3 for RHEL 8 jws5-tomcat-9.0.30-5.redhat_6.1.el8jws, jws5-tomcat-admin-webapps-9.0.30-5.redhat_6.1.el8jws, jws5-tomcat-docs-webapp-9.0.30-5.redhat_6.1.el8jws +7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tomcat — openSUSE-SU-2020:1102

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    Show all 2 records → Advisory →
  • Advisory ·

    Apache Tomcat — openSUSE-SU-2020:1111

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss Web Server (JWS) 5.3Fixed RHSA-2020:3308
Red Hat JBoss Web Server 5.3 for RHEL 6 ServerFixed RHSA-2020:3306
Red Hat JBoss Web Server 5.3 for RHEL 7 ServerFixed RHSA-2020:3306
Red Hat JBoss Web Server 5.3 for RHEL 8Fixed RHSA-2020:3306
Red Hat Runtimes Spring Boot 2.2.6Fixed RHSA-2020:3806
Not affected: 8 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Web Server 3
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Process Automation 7
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13934
  2. 2026-10-03 Alias added: GHSA-vf77-8h7g-gghp
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 5

Advisory 8

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences