Read the docs
TI-2020-10912 Aliases CVE-2020-13935GHSA-m7jv-hq7h-mq7c

Infinite loop in Apache Tomcat

Priority HIGH 81CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 22 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.86608 99th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.0.0-M7, 9.0.37, 8.5.57 +1org.apache.tomcat.embed:tomcat-embed-websocket (Maven): 7.0.105, 8.5.57, 9.0.37 +1+1 more productRed Hat: 12 advisoriesRed Hat: 22 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache TomcatApache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, 7.0.27 to 7.0.104—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)10.0.0-M1 to before 10.0.0-M710.0.0-M7Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat:tomcat (Maven)9.0.0.M1 to before 9.0.379.0.37Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat:tomcat (Maven)8.5.0 to before 8.5.578.5.57Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat:tomcat (Maven)7.0.27 to before 7.0.1057.0.105Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat.embed:tomcat-embed-websocket (Maven)7.0.27 to before 7.0.1057.0.105Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat.embed:tomcat-embed-websocket (Maven)8.5.0 to before 8.5.578.5.57Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat.embed:tomcat-embed-websocket (Maven)9.0.0.M1 to before 9.0.379.0.37Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat.embed:tomcat-embed-websocket (Maven)10.0.0-M1 to before 10.0.0-M710.0.0-M7Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat:tomcat-websocket (Maven)10.0.0-M1 to before 10.0.0-M710.0.0-M7Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat:tomcat-websocket (Maven)9.0.0.M1 to before 9.0.379.0.37Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat:tomcat-websocket (Maven)8.5.0 to before 8.5.578.5.57Patch availableGHSA-m7jv-hq7h-mq7c
—org.apache.tomcat:tomcat-websocket (Maven)7.0.27 to before 7.0.1057.0.105Patch availableGHSA-m7jv-hq7h-mq7c
  • Apache Tomcat Vendor— Affected Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, 7.0.27 to 7.0.104 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M7 Fixed in 10.0.0-M7 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.37 Fixed in 9.0.37 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.0 to before 8.5.57 Fixed in 8.5.57 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.27 to before 7.0.105 Fixed in 7.0.105 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat.embed:tomcat-embed-websocket (Maven) Vendor— Affected 7.0.27 to before 7.0.105 Fixed in 7.0.105 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat.embed:tomcat-embed-websocket (Maven) Vendor— Affected 8.5.0 to before 8.5.57 Fixed in 8.5.57 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat.embed:tomcat-embed-websocket (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.37 Fixed in 9.0.37 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat.embed:tomcat-embed-websocket (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M7 Fixed in 10.0.0-M7 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat:tomcat-websocket (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M7 Fixed in 10.0.0-M7 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat:tomcat-websocket (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.37 Fixed in 9.0.37 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat:tomcat-websocket (Maven) Vendor— Affected 8.5.0 to before 8.5.57 Fixed in 8.5.57 Patch available GHSA-m7jv-hq7h-mq7c
  • org.apache.tomcat:tomcat-websocket (Maven) Vendor— Affected 7.0.27 to before 7.0.105 Fixed in 7.0.105 Patch available GHSA-m7jv-hq7h-mq7c

CPE configurations NVD · 72

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*7.0.27 – 7.0.104; 8.5.0 – 8.5.56; 9.0.1 – 9.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*9.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*9.0.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*9.0.0 milestone11VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*9.0.0 milestone12VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*9.0.0 milestone13VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*9.0.0 milestone14VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*9.0.0 milestone15VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*9.0.0 milestone16VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*9.0.0 milestone17VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.27 – 7.0.104; 8.5.0 – 8.5.56; 9.0.1 – 9.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
Show 62 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*9.0.0 milestone18VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*9.0.0 milestone19VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*9.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*9.0.0 milestone20VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*9.0.0 milestone21VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*9.0.0 milestone22VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*9.0.0 milestone23VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*9.0.0 milestone24VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*9.0.0 milestone25VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*9.0.0 milestone26VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*9.0.0 milestone27VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*9.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*9.0.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*9.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*9.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*9.0.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*9.0.0 milestone8VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*9.0.0 milestone9VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*10.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*10.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*10.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*10.0.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*10.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*10.0.0 milestone6VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*3.0.0 – 3.1.3VulnerableNetApp
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*5.9.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*5.9.1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*5.10.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*5.10.0 update_1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*5.10.0 update_2VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*5.10.0 update_3VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*5.10.0 update_4VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*5.10.0 update_5VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*5.10.0 update_6VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*5.10.0 update_7VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*5.10.0 update_8VulnerableMcAfee
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*9.3.3VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*9.3.5VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*10.0.1.5.0VulnerableOracle
cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*17.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*17.3VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 8.0.21VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 20.12VulnerableOracle
cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*19cVulnerableOracle
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* Versions 10.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* Versions 10.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* Versions 10.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* Versions 10.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* Versions 10.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:* Versions 10.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.1.3 Vulnerable ·NetApp
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:* Versions 5.9.1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* Versions 5.10.0 update_1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* Versions 5.10.0 update_2 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* Versions 5.10.0 update_3 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* Versions 5.10.0 update_4 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* Versions 5.10.0 update_5 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* Versions 5.10.0 update_6 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* Versions 5.10.0 update_7 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* Versions 5.10.0 update_8 Vulnerable ·McAfee
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.21 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle

Remediation

  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat:tomcat (Maven) Fixed in 10.0.0-M7 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat:tomcat (Maven) Fixed in 9.0.37 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat:tomcat (Maven) Fixed in 8.5.57 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat:tomcat (Maven) Fixed in 7.0.105 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat.embed:tomcat-embed-websocket (Maven) Fixed in 7.0.105 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat.embed:tomcat-embed-websocket (Maven) Fixed in 8.5.57 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat.embed:tomcat-embed-websocket (Maven) Fixed in 9.0.37 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat.embed:tomcat-embed-websocket (Maven) Fixed in 10.0.0-M7 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat:tomcat-websocket (Maven) Fixed in 10.0.0-M7 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat:tomcat-websocket (Maven) Fixed in 9.0.37 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat:tomcat-websocket (Maven) Fixed in 8.5.57 Advisory →
  • Fix · GHSA-m7jv-hq7h-mq7c org.apache.tomcat:tomcat-websocket (Maven) Fixed in 7.0.105 Advisory →

Red Hat 12 advisories

  • RHSA-2022:5460 Released 2022-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.24 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server jboss-as-appclient-7.5.24-2.Final_redhat_00001.1.ep6.el7, jboss-as-cli-7.5.24-2.Final_redhat_00001.1.ep6.el7, jboss-as-client-all-7.5.24-2.Final_redhat_00001.1.ep6.el7 +47
  • RHSA-2022:5459 Released 2022-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.24 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-as-appclient-7.5.24-2.Final_redhat_00001.1.ep6.el6, jboss-as-cli-7.5.24-2.Final_redhat_00001.1.ep6.el6, jboss-as-client-all-7.5.24-2.Final_redhat_00001.1.ep6.el6 +47
  • RHSA-2022:5458 Released 2022-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.24 security update
    • EAP 6.4.24 release
Show 9 more Red Hat advisories
  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:4004 Released 2020-09-29 · Red Hat rating Important
    tomcat security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-15.el7, tomcat-servlet-3.0-api-7.0.76-15.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
    • Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-15.el7, tomcat-servlet-3.0-api-7.0.76-15.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
    • Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-el-2.2-api-7.0.76-15.el7 +4
    • Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
    • Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-el-2.2-api-7.0.76-15.el7 +4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-15.el7, tomcat-javadoc-7.0.76-15.el7, tomcat-jsvc-7.0.76-15.el7
  • RHSA-2020:3806 Released 2020-09-23 · Red Hat rating Important
    Red Hat support for Spring Boot 2.2.6.SP2 security update
    • Red Hat Runtimes Spring Boot 2.2.6
  • RHSA-2020:3383 Released 2020-08-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server jbossweb-7.5.31-2.Final_redhat_2.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jbossweb-7.5.31-2.Final_redhat_2.1.ep6.el6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server jbossweb-7.5.31-2.Final_redhat_2.1.ep6.el7
  • RHSA-2020:3382 Released 2020-08-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 async
  • RHSA-2020:3308 Released 2020-08-04 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3.2 security update
    • Red Hat JBoss Web Server (JWS) 5.3
  • RHSA-2020:3306 Released 2020-08-04 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3.2 security update
    • Red Hat JBoss Web Server 5.3 for RHEL 6 Server jws5-tomcat-9.0.30-5.redhat_6.1.el6jws, jws5-tomcat-admin-webapps-9.0.30-5.redhat_6.1.el6jws, jws5-tomcat-docs-webapp-9.0.30-5.redhat_6.1.el6jws +7
    • Red Hat JBoss Web Server 5.3 for RHEL 7 Server jws5-tomcat-9.0.30-5.redhat_6.1.el7jws, jws5-tomcat-admin-webapps-9.0.30-5.redhat_6.1.el7jws, jws5-tomcat-docs-webapp-9.0.30-5.redhat_6.1.el7jws +7
    • Red Hat JBoss Web Server 5.3 for RHEL 8 jws5-tomcat-9.0.30-5.redhat_6.1.el8jws, jws5-tomcat-admin-webapps-9.0.30-5.redhat_6.1.el8jws, jws5-tomcat-docs-webapp-9.0.30-5.redhat_6.1.el8jws +7
  • RHSA-2020:3303 Released 2020-08-04 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1 Service Pack 10 security update
    • Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat7-7.0.70-41.ep7.el6, tomcat7-admin-webapps-7.0.70-41.ep7.el6, tomcat7-docs-webapp-7.0.70-41.ep7.el6 +21
    • Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat7-7.0.70-41.ep7.el7, tomcat7-admin-webapps-7.0.70-41.ep7.el7, tomcat7-docs-webapp-7.0.70-41.ep7.el7 +21
  • RHSA-2020:3305 Released 2020-08-04 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1 Service Pack 10 security update
    • Red Hat JBoss Web Server 3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tomcat — openSUSE-SU-2020:1102

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    Show all 2 records → Advisory →
  • Advisory ·

    Apache Tomcat — openSUSE-SU-2020:1111

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Out of support scope
EAP 6.4.24 releaseFixed RHSA-2022:5458
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:4004
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:4004
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:4004
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:4004
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:4004
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:4004
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:4004
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:4004
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss Enterprise Application Platform 6.4 asyncFixed RHSA-2020:3382
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2020:3383
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2020:3383, RHSA-2022:5459
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2020:3383, RHSA-2022:5460
Red Hat JBoss Web Server (JWS) 5.3Fixed RHSA-2020:3308
Red Hat JBoss Web Server 3.1Fixed RHSA-2020:3305
Red Hat JBoss Web Server 3.1 for RHEL 6Fixed RHSA-2020:3303
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2020:3303
Red Hat JBoss Web Server 5.3 for RHEL 6 ServerFixed RHSA-2020:3306
Red Hat JBoss Web Server 5.3 for RHEL 7 ServerFixed RHSA-2020:3306
Red Hat JBoss Web Server 5.3 for RHEL 8Fixed RHSA-2020:3306
Red Hat Runtimes Spring Boot 2.2.6Fixed RHSA-2020:3806
Not affected: 4 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 9
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13935
  2. 2026-10-03 Alias added: GHSA-m7jv-hq7h-mq7c
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 6

Advisory 11

Other 15

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences