{"id":"CVE-2020-11996","published":"2020-06-26T16:27:20Z","modified":"2026-10-08T21:13:56Z","title":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and…","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.26699,"percentile":0.98023,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r5541ef6b6b68b49f76fc4c45695940116da2bcbe0312ef204a00a2e0%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb4ee49ecc4c59620ffd5e66e84a17e526c2c3cfa95d0cd682d90d338%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb820f1a2a02bf07414be12c653c2ab5321fd87b9bf6c5e635c53ff4b%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r74f5a8204efe574cbfcd95b2a16236fe95beb45c4d9fee3dc789dca9%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rea65d6ef2e45dd1c45faae83922042732866c7b88fa109b76c83db52%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc80b96b4b96618b2b7461cb90664a428cfd6605eea9f74e51b792542%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r93ca628ef3a4530dfe5ac49fddc795f0920a4b2a408b57a30926a42b%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r8f3d416c193bc9384a8a7dd368623d441f5fcaff1057115008100561%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9ad911fe49450ed9405827af0e7a74104041081ff91864b1f2546bbd%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ref0339792ac6dac1dba83c071a727ad72380899bde60f6aaad4031b9%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6c29801370a36c1a5159679269777ad0c73276d3015b8bbefea66e5c%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2020/dsa-4727","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200709-0002/","tags":["x_refsource_CONFIRM"]},{"url":"https://usn.ubuntu.com/4596-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r5a4f80a6acc6607d61dae424b643b594c6188dd4e1eff04705c10db2%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":24.6,"factors":[{"name":"EPSS percentile","points":19.6},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2020-07-27","earliestUrl":"https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996","repos":[{"name":"rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996","url":"https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996","stars":5,"created":"2020-07-27"}]},"first":{"date":"2020-07-27","source":"PoC-in-GitHub","url":"https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996"},"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache","product":"Apache Tomcat","versions":["10.0.0-M1 to 10.0.0-M5","9.0.0.M1 to 9.0.35","8.5.0 to 8.5.55"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M5",">=9.0.0.M1, <9.0.35",">=8.5.0, <8.5.55"],"patched":["10.0.0-M5","9.0.35","8.5.55"],"from":["GHSA-53hp-jpwq-2jgq"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M5",">=9.0.0.M1, <9.0.35",">=8.5.0, <8.5.55"],"patched":["10.0.0-M5","9.0.35","8.5.55"],"from":["GHSA-53hp-jpwq-2jgq"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0828","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-7675","children":[{"from":"CVE-2020-11996","to":"CVE-2020-13943","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Http2UpgradeHandler.java"],"commits":["https://github.com/apache/tomcat/commit/9434a44d3449d620b1be70206819f8275b4a7509","https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b0c976","https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb","https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b"],"basis":"shared function","functions":["headersStart"]}]},{"from":"CVE-2020-11996","to":"CVE-2024-34750","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Http2UpgradeHandler.java"],"commits":["https://github.com/apache/tomcat/commit/9434a44d3449d620b1be70206819f8275b4a7509","https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b0c976","https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2","https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3"],"basis":"shared function","functions":["headersStart"]}]}],"packageHistory":[{"cve":"CVE-2022-25762","published":"2022-05-13","fixed":"9.0.20","kev":false},{"cve":"CVE-2019-17569","published":"2020-02-24","fixed":"9.0.31","kev":false,"link":{"from":"CVE-2019-17569","to":"CVE-2020-11996","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.31","toFixed":"9.0.35","daysApart":123},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.51","toFixed":"8.5.55","daysApart":123}]}},{"cve":"CVE-2020-1935","published":"2020-02-24","fixed":"9.0.31","kev":false},{"cve":"CVE-2020-11996","published":"2020-06-26","fixed":"10.0.0-M5","kev":false},{"cve":"CVE-2020-13934","published":"2020-07-14","fixed":"10.0.0-M6","kev":false,"link":{"from":"CVE-2020-11996","to":"CVE-2020-13934","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.35","toFixed":"9.0.36","daysApart":18},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.55","toFixed":"8.5.56","daysApart":18},{"kind":"similar","provenance":"machine","score":0.24,"basis":"same package + description similarity"}]}},{"cve":"CVE-2020-13935","published":"2020-07-14","fixed":"10.0.0-M7","kev":false},{"cve":"CVE-2021-41079","published":"2021-09-16","fixed":"10.0.4","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}