Apache Tomcat: Request header mix-up between HTTP/2 streams
Priority MEDIUM 60CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 5 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.24622 97th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat-coyote (Maven): 10.0.0-M10, 9.0.40, 8.5.60Red Hat: 4 advisoriesRed Hat: 5 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9; Apache Tomcat 9 9.0.0-M1 to 9.0.39; Apache Tomcat 8.5 8.5.0 to 8.5.59 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 10.0.0-M1 to before 10.0.0-M10 | 10.0.0-M10 | Patch available | GHSA-vvw4-rfwf-p6hx |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 9.0.0-M1 to before 9.0.40 | 9.0.40 | Patch available | GHSA-vvw4-rfwf-p6hx |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 8.5.0 to before 8.5.60 | 8.5.60 | Patch available | GHSA-vvw4-rfwf-p6hx |
- Apache Tomcat VendorApache Affected Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9; Apache Tomcat 9 9.0.0-M1 to 9.0.39; Apache Tomcat 8.5 8.5.0 to 8.5.59 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M10 Fixed in 10.0.0-M10 Patch available GHSA-vvw4-rfwf-p6hx
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 9.0.0-M1 to before 9.0.40 Fixed in 9.0.40 Patch available GHSA-vvw4-rfwf-p6hx
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.5.0 to before 8.5.60 Fixed in 8.5.60 Patch available GHSA-vvw4-rfwf-p6hx
CPE configurations NVD · 54
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 8.5.1 – 8.5.59; 9.0.1 – 9.0.35 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* | 9.0.0 milestone16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* | 9.0.0 milestone17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* | 9.0.0 milestone18 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.1 – 8.5.59; 9.0.1 – 9.0.35 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
Show 44 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* | 9.0.0 milestone19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* | 9.0.0 milestone20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* | 9.0.0 milestone21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* | 9.0.0 milestone22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* | 9.0.0 milestone23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* | 9.0.0 milestone24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* | 9.0.0 milestone25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* | 9.0.0 milestone26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* | 9.0.0 milestone27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.35-3.39.1:*:*:*:*:*:*:* | 9.0.35-3.39.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.35-3.57.3:*:*:*:*:*:*:* | 9.0.35-3.57.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:* | 9.0.36 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:* | 9.0.37 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.38:*:*:*:*:*:*:* | 9.0.38 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.39:*:*:*:*:*:*:* | 9.0.39 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* | 10.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* | 10.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* | 10.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* | 10.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* | 10.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:* | 10.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:* | 10.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:* | 10.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:* | 10.0.0 milestone9 | Vulnerable | Apache |
| cpe:2.3:a:netapp:element_plug-in:-:*:*:*:*:vcenter_server:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* | 3.0.0 – 3.1.3 | Vulnerable | NetApp |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* | before 21.1.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:* | 1.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* | 10.0.1.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* | 17.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* | 17.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* | 17.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | before 8.0.23 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* | 19c | Vulnerable | Oracle |
- cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.35-3.39.1:*:*:*:*:*:*:* Versions 9.0.35-3.39.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.35-3.57.3:*:*:*:*:*:*:* Versions 9.0.35-3.57.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:* Versions 9.0.36 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:* Versions 9.0.37 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.38:*:*:*:*:*:*:* Versions 9.0.38 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.39:*:*:*:*:*:*:* Versions 9.0.39 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* Versions 10.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* Versions 10.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* Versions 10.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* Versions 10.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* Versions 10.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:* Versions 10.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:* Versions 10.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:* Versions 10.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:* Versions 10.0.0 milestone9 Vulnerable ·Apache
- cpe:2.3:a:netapp:element_plug-in:-:*:*:*:*:vcenter_server:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.1.3 Vulnerable ·NetApp
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions before 8.0.23 Vulnerable ·Oracle
- cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
Remediation
- Fix · GHSA-vvw4-rfwf-p6hx org.apache.tomcat:tomcat-coyote (Maven) Fixed in 10.0.0-M10 Advisory →
- Fix · GHSA-vvw4-rfwf-p6hx org.apache.tomcat:tomcat-coyote (Maven) Fixed in 9.0.40 Advisory →
- Fix · GHSA-vvw4-rfwf-p6hx org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.5.60 Advisory →
Red Hat 4 advisories
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:4012 Released 2021-10-28 · Red Hat rating ModerateRed Hat support for Spring Boot 2.4.9 security update
- Red Hat Support for Spring Boot 2.4.9
- RHSA-2021:0494 Released 2021-02-11 · Red Hat rating ModerateRed Hat JBoss Web Server 5.4.1 Security Update
- Red Hat JBoss Web Server 5.4 for RHEL 7 Server jws5-tomcat-9.0.36-9.redhat_8.1.el7jws, jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el7jws, jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el7jws +8
- Red Hat JBoss Web Server 5.4 for RHEL 8 jws5-tomcat-9.0.36-9.redhat_8.1.el8jws, jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el8jws, jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el8jws +8
Show 1 more Red Hat advisories
- RHSA-2021:0495 Released 2021-02-11 · Red Hat rating ModerateRed Hat JBoss Web Server 5.4.1 Security Update
- Red Hat JBoss Web Server 5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat JBoss Web Server 5 | Fixed | RHSA-2021:0495 |
| Red Hat JBoss Web Server 5.4 for RHEL 7 Server | Fixed | RHSA-2021:0494 |
| Red Hat JBoss Web Server 5.4 for RHEL 8 | Fixed | RHSA-2021:0494 |
| Red Hat Support for Spring Boot 2.4.9 | Fixed | RHSA-2021:4012 |
Not affected: 9 products
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
- Red Hat JBoss Web Server 3
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-17527
- 2026-10-03 Alias added: GHSA-vvw4-rfwf-p6hx
- 2026-10-08 CISA SSVC decision points changed
References
Patch 4
Advisory 7
- https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
- [oss-security] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up
- [debian-lts-announce] 20201216 [SECURITY] [DLA 2495-1] tomcat8 security update
- GLSA-202012-23
- DSA-4835
- https://security.netapp.com/advisory/ntap-20201210-0003/
- https://nvd.nist.gov/vuln/detail/CVE-2020-17527
Other 38
- [tomcat-dev] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up
- [tomcat-dev] 20201203 svn commit: r1884073 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml
- [announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up
- [tomcat-users] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up
- [guacamole-issues] 20201206 [jira] [Created] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527
- [guacamole-issues] 20201206 [jira] [Commented] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527
- [tomee-commits] 20201207 [jira] [Created] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.
- [tomee-commits] 20201207 [jira] [Assigned] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.
- [tomcat-dev] 20210114 svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml
- [announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up
- [tomcat-dev] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up
- [tomcat-announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up
- [tomcat-users] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up
- [tomee-commits] 20210319 [jira] [Updated] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.
- https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29
- https://github.com/apache/tomcat/commit/8d2fe6894d6e258a6d615d7f786acca80e6020cb
- https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65
- https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20201210-0003
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-9.html
- https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E
- https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E
- https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E
- https://github.com/apache/tomcat
- https://bz.apache.org/bugzilla/show_bug.cgi?id=64830
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2020-17527 · CVE Program
- CVE-2020-17527 · NVD
- FIRST EPSS
- GHSA-vvw4-rfwf-p6hx · GitHub Advisory Database · CC BY 4.0
- CVE-2020-17527 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences