{"id":"CVE-2020-13943","published":"2020-10-12T13:46:47Z","modified":"2026-10-08T21:13:52Z","title":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded…","vendor":null,"product":null,"tier":"tail","description":{"text":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.52639,"percentile":0.98967,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://www.debian.org/security/2021/dsa-4835","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0007/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":19.8,"factors":[{"name":"EPSS percentile","points":19.79}]},"affectedVersions":[{"vendor":"n/a","product":"Apache Tomcat","versions":["Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M8",">=9.0.0-M1, <9.0.38",">=8.5.0, <8.5.58"],"patched":["10.0.0-M8","9.0.38","8.5.58"],"from":["GHSA-f268-65qc-98vg"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0967","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-7675","parents":[{"from":"CVE-2020-11996","to":"CVE-2020-13943","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Http2UpgradeHandler.java"],"commits":["https://github.com/apache/tomcat/commit/9434a44d3449d620b1be70206819f8275b4a7509","https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b0c976","https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb","https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b"],"basis":"shared function","functions":["headersStart"]}]}],"children":[{"from":"CVE-2020-13943","to":"CVE-2024-24549","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Http2Parser.java"],"commits":["https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb","https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b","https://github.com/apache/tomcat/commit/0cac540a882220231ba7a82330483cbd5f6b1f96","https://github.com/apache/tomcat/commit/810f49d5ff6d64b704af85d5b8d0aab9ec3c83f5"],"basis":"rarely changed file"}]},{"from":"CVE-2020-13943","to":"CVE-2024-34750","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Http2UpgradeHandler.java"],"commits":["https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb","https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b","https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2","https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3"],"basis":"shared function","functions":["headersStart"]}]},{"from":"CVE-2020-13943","to":"CVE-2025-48989","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Http2UpgradeHandler.java"],"commits":["https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb","https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b","https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255","https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06"],"basis":"shared function","functions":["headersContinue"]}]}],"packageHistory":[{"cve":"CVE-2025-52434","published":"2025-07-10","fixed":"9.0.107","kev":false},{"cve":"CVE-2020-17527","published":"2020-12-03","fixed":"10.0.0-M10","kev":false,"link":{"from":"CVE-2020-13943","to":"CVE-2020-17527","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.38","toFixed":"9.0.40","daysApart":52},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"8.5.58","toFixed":"8.5.60","daysApart":52}]}},{"cve":"CVE-2020-13934","published":"2020-07-14","fixed":"10.0.0-M6","kev":false,"link":{"from":"CVE-2020-13934","to":"CVE-2020-13943","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.36","toFixed":"9.0.38","daysApart":90},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"10.0.0-M6","toFixed":"10.0.0-M8","daysApart":90}]}},{"cve":"CVE-2020-13943","published":"2020-10-12","fixed":"10.0.0-M8","kev":false},{"cve":"CVE-2021-25122","published":"2021-03-01","fixed":"10.0.2","kev":false,"link":{"from":"CVE-2020-13943","to":"CVE-2021-25122","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"10.0.0-M8","toFixed":"10.0.2","daysApart":140}]}},{"cve":"CVE-2022-42252","published":"2022-11-01","fixed":"10.1.1","kev":false},{"cve":"CVE-2023-46589","published":"2023-11-28","fixed":"11.0.0-M11","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-coyote"}}