Read the docs
TI-2020-10919 Aliases CVE-2020-13943GHSA-f268-65qc-98vg

Information disclosure in Apache Tomcat

Priority MEDIUM 58CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 5 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.52639 98th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat-coyote (Maven): 10.0.0-M8, 9.0.38, 8.5.58Red Hat: 4 advisoriesRed Hat: 5 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache TomcatApache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57—No fix listedCNA
—org.apache.tomcat:tomcat-coyote (Maven)10.0.0-M1 to before 10.0.0-M810.0.0-M8Patch availableGHSA-f268-65qc-98vg
—org.apache.tomcat:tomcat-coyote (Maven)9.0.0-M1 to before 9.0.389.0.38Patch availableGHSA-f268-65qc-98vg
—org.apache.tomcat:tomcat-coyote (Maven)8.5.0 to before 8.5.588.5.58Patch availableGHSA-f268-65qc-98vg
  • Apache Tomcat Vendor— Affected Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M8 Fixed in 10.0.0-M8 Patch available GHSA-f268-65qc-98vg
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 9.0.0-M1 to before 9.0.38 Fixed in 9.0.38 Patch available GHSA-f268-65qc-98vg
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.5.0 to before 8.5.58 Fixed in 8.5.58 Patch available GHSA-f268-65qc-98vg

CPE configurations NVD · 131

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*8.5.0VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*8.5.1VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*8.5.2VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*8.5.3VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*8.5.4VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*8.5.5VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*8.5.6VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*8.5.7VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*8.5.8VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*8.5.9VulnerableApache
  • cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:* Versions 8.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:* Versions 8.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:* Versions 8.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:* Versions 8.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:* Versions 8.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:* Versions 8.5.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:* Versions 8.5.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:* Versions 8.5.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:* Versions 8.5.9 Vulnerable ·Apache
Show 121 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*8.5.10VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*8.5.11VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*8.5.12VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*8.5.13VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*8.5.14VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*8.5.15VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.16:*:*:*:*:*:*:*8.5.16VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.17:*:*:*:*:*:*:*8.5.17VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.18:*:*:*:*:*:*:*8.5.18VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.19:*:*:*:*:*:*:*8.5.19VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.20:*:*:*:*:*:*:*8.5.20VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.21:*:*:*:*:*:*:*8.5.21VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.22:*:*:*:*:*:*:*8.5.22VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.23:*:*:*:*:*:*:*8.5.23VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.24:*:*:*:*:*:*:*8.5.24VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.25:*:*:*:*:*:*:*8.5.25VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.26:*:*:*:*:*:*:*8.5.26VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.27:*:*:*:*:*:*:*8.5.27VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.28:*:*:*:*:*:*:*8.5.28VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.29:*:*:*:*:*:*:*8.5.29VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.30:*:*:*:*:*:*:*8.5.30VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.31:*:*:*:*:*:*:*8.5.31VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.32:*:*:*:*:*:*:*8.5.32VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.33:*:*:*:*:*:*:*8.5.33VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.34:*:*:*:*:*:*:*8.5.34VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.35:*:*:*:*:*:*:*8.5.35VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.36:*:*:*:*:*:*:*8.5.36VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.37:*:*:*:*:*:*:*8.5.37VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.38:*:*:*:*:*:*:*8.5.38VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.39:*:*:*:*:*:*:*8.5.39VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.40:*:*:*:*:*:*:*8.5.40VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.41:*:*:*:*:*:*:*8.5.41VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.42:*:*:*:*:*:*:*8.5.42VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.43:*:*:*:*:*:*:*8.5.43VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.44:*:*:*:*:*:*:*8.5.44VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.45:*:*:*:*:*:*:*8.5.45VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.46:*:*:*:*:*:*:*8.5.46VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.47:*:*:*:*:*:*:*8.5.47VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.48:*:*:*:*:*:*:*8.5.48VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.49:*:*:*:*:*:*:*8.5.49VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.50:*:*:*:*:*:*:*8.5.50VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.51:*:*:*:*:*:*:*8.5.51VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.52:*:*:*:*:*:*:*8.5.52VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.53:*:*:*:*:*:*:*8.5.53VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.54:*:*:*:*:*:*:*8.5.54VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.55:*:*:*:*:*:*:*8.5.55VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.56:*:*:*:*:*:*:*8.5.56VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.57:*:*:*:*:*:*:*8.5.57VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*9.0.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*9.0.0 milestone11VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*9.0.0 milestone12VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*9.0.0 milestone13VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*9.0.0 milestone14VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*9.0.0 milestone15VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*9.0.0 milestone16VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*9.0.0 milestone17VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*9.0.0 milestone18VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*9.0.0 milestone19VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*9.0.0 milestone20VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*9.0.0 milestone21VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*9.0.0 milestone22VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*9.0.0 milestone23VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*9.0.0 milestone24VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*9.0.0 milestone25VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*9.0.0 milestone26VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*9.0.0 milestone27VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*9.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*9.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*9.0.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*9.0.0 milestone8VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*9.0.0 milestone9VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.1:*:*:*:*:*:*:*9.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.2:*:*:*:*:*:*:*9.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.3:*:*:*:*:*:*:*9.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.4:*:*:*:*:*:*:*9.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.5:*:*:*:*:*:*:*9.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.6:*:*:*:*:*:*:*9.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.7:*:*:*:*:*:*:*9.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.8:*:*:*:*:*:*:*9.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.9:*:*:*:*:*:*:*9.0.9VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.10:*:*:*:*:*:*:*9.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.11:*:*:*:*:*:*:*9.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.12:*:*:*:*:*:*:*9.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.13:*:*:*:*:*:*:*9.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.14:*:*:*:*:*:*:*9.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.15:*:*:*:*:*:*:*9.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.16:*:*:*:*:*:*:*9.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.17:*:*:*:*:*:*:*9.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.18:*:*:*:*:*:*:*9.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.19:*:*:*:*:*:*:*9.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.20:*:*:*:*:*:*:*9.0.20VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.21:*:*:*:*:*:*:*9.0.21VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.22:*:*:*:*:*:*:*9.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.23:*:*:*:*:*:*:*9.0.23VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.24:*:*:*:*:*:*:*9.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.25:*:*:*:*:*:*:*9.0.25VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.26:*:*:*:*:*:*:*9.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.27:*:*:*:*:*:*:*9.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.28:*:*:*:*:*:*:*9.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.29:*:*:*:*:*:*:*9.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.30:*:*:*:*:*:*:*9.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.31:*:*:*:*:*:*:*9.0.31VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.32:*:*:*:*:*:*:*9.0.32VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.33:*:*:*:*:*:*:*9.0.33VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:*9.0.34VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.35:*:*:*:*:*:*:*9.0.35VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*9.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*9.0.37VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*10.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*10.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*10.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*10.0.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*10.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*10.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*10.0.0 milestone7VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*17.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*17.3VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
  • cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:* Versions 8.5.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:* Versions 8.5.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:* Versions 8.5.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:* Versions 8.5.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:* Versions 8.5.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:* Versions 8.5.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.16:*:*:*:*:*:*:* Versions 8.5.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.17:*:*:*:*:*:*:* Versions 8.5.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.18:*:*:*:*:*:*:* Versions 8.5.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.19:*:*:*:*:*:*:* Versions 8.5.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.20:*:*:*:*:*:*:* Versions 8.5.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.21:*:*:*:*:*:*:* Versions 8.5.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.22:*:*:*:*:*:*:* Versions 8.5.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.23:*:*:*:*:*:*:* Versions 8.5.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.24:*:*:*:*:*:*:* Versions 8.5.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.25:*:*:*:*:*:*:* Versions 8.5.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.26:*:*:*:*:*:*:* Versions 8.5.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.27:*:*:*:*:*:*:* Versions 8.5.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.28:*:*:*:*:*:*:* Versions 8.5.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.29:*:*:*:*:*:*:* Versions 8.5.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.30:*:*:*:*:*:*:* Versions 8.5.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.31:*:*:*:*:*:*:* Versions 8.5.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.32:*:*:*:*:*:*:* Versions 8.5.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.33:*:*:*:*:*:*:* Versions 8.5.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.34:*:*:*:*:*:*:* Versions 8.5.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.35:*:*:*:*:*:*:* Versions 8.5.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.36:*:*:*:*:*:*:* Versions 8.5.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.37:*:*:*:*:*:*:* Versions 8.5.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.38:*:*:*:*:*:*:* Versions 8.5.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.39:*:*:*:*:*:*:* Versions 8.5.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.40:*:*:*:*:*:*:* Versions 8.5.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.41:*:*:*:*:*:*:* Versions 8.5.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.42:*:*:*:*:*:*:* Versions 8.5.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.43:*:*:*:*:*:*:* Versions 8.5.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.44:*:*:*:*:*:*:* Versions 8.5.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.45:*:*:*:*:*:*:* Versions 8.5.45 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.46:*:*:*:*:*:*:* Versions 8.5.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.47:*:*:*:*:*:*:* Versions 8.5.47 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.48:*:*:*:*:*:*:* Versions 8.5.48 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.49:*:*:*:*:*:*:* Versions 8.5.49 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.50:*:*:*:*:*:*:* Versions 8.5.50 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.51:*:*:*:*:*:*:* Versions 8.5.51 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.52:*:*:*:*:*:*:* Versions 8.5.52 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.53:*:*:*:*:*:*:* Versions 8.5.53 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.54:*:*:*:*:*:*:* Versions 8.5.54 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.55:*:*:*:*:*:*:* Versions 8.5.55 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.56:*:*:*:*:*:*:* Versions 8.5.56 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.57:*:*:*:*:*:*:* Versions 8.5.57 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.1:*:*:*:*:*:*:* Versions 9.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.2:*:*:*:*:*:*:* Versions 9.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.3:*:*:*:*:*:*:* Versions 9.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.4:*:*:*:*:*:*:* Versions 9.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.5:*:*:*:*:*:*:* Versions 9.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.6:*:*:*:*:*:*:* Versions 9.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.7:*:*:*:*:*:*:* Versions 9.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.8:*:*:*:*:*:*:* Versions 9.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.9:*:*:*:*:*:*:* Versions 9.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.10:*:*:*:*:*:*:* Versions 9.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.11:*:*:*:*:*:*:* Versions 9.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.12:*:*:*:*:*:*:* Versions 9.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.13:*:*:*:*:*:*:* Versions 9.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.14:*:*:*:*:*:*:* Versions 9.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.15:*:*:*:*:*:*:* Versions 9.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.16:*:*:*:*:*:*:* Versions 9.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.17:*:*:*:*:*:*:* Versions 9.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.18:*:*:*:*:*:*:* Versions 9.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.19:*:*:*:*:*:*:* Versions 9.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.20:*:*:*:*:*:*:* Versions 9.0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.21:*:*:*:*:*:*:* Versions 9.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.22:*:*:*:*:*:*:* Versions 9.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.23:*:*:*:*:*:*:* Versions 9.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.24:*:*:*:*:*:*:* Versions 9.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.25:*:*:*:*:*:*:* Versions 9.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.26:*:*:*:*:*:*:* Versions 9.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.27:*:*:*:*:*:*:* Versions 9.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.28:*:*:*:*:*:*:* Versions 9.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.29:*:*:*:*:*:*:* Versions 9.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.30:*:*:*:*:*:*:* Versions 9.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.31:*:*:*:*:*:*:* Versions 9.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.32:*:*:*:*:*:*:* Versions 9.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.33:*:*:*:*:*:*:* Versions 9.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:* Versions 9.0.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.35:*:*:*:*:*:*:* Versions 9.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:* Versions 9.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:* Versions 9.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* Versions 10.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* Versions 10.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* Versions 10.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* Versions 10.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* Versions 10.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:* Versions 10.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:* Versions 10.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-f268-65qc-98vg org.apache.tomcat:tomcat-coyote (Maven) Fixed in 10.0.0-M8 Advisory →
  • Fix · GHSA-f268-65qc-98vg org.apache.tomcat:tomcat-coyote (Maven) Fixed in 9.0.38 Advisory →
  • Fix · GHSA-f268-65qc-98vg org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.5.58 Advisory →

Red Hat 4 advisories

  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:4012 Released 2021-10-28 · Red Hat rating Moderate
    Red Hat support for Spring Boot 2.4.9 security update
    • Red Hat Support for Spring Boot 2.4.9
  • RHSA-2021:0494 Released 2021-02-11 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.4.1 Security Update
    • Red Hat JBoss Web Server 5.4 for RHEL 7 Server jws5-tomcat-9.0.36-9.redhat_8.1.el7jws, jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el7jws, jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el7jws +8
    • Red Hat JBoss Web Server 5.4 for RHEL 8 jws5-tomcat-9.0.36-9.redhat_8.1.el8jws, jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el8jws, jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el8jws +8
Show 1 more Red Hat advisories
  • RHSA-2021:0495 Released 2021-02-11 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.4.1 Security Update
    • Red Hat JBoss Web Server 5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss Web Server 5Fixed RHSA-2021:0495
Red Hat JBoss Web Server 5.4 for RHEL 7 ServerFixed RHSA-2021:0494
Red Hat JBoss Web Server 5.4 for RHEL 8Fixed RHSA-2021:0494
Red Hat Support for Spring Boot 2.4.9Fixed RHSA-2021:4012
Not affected: 7 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss Web Server 3
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Process Automation 7
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13943
  2. 2026-10-03 Alias added: GHSA-f268-65qc-98vg
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-10-30 EPSS moved to the 95th–99th percentile

References

Patch 1

Advisory 7

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences