Patchfirst
Patchfirst
CVE-2020-13935 Public exploit EPSS 86.6%

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1…

Summary

The payload length check for WebSocket frames in Apache Tomcat versions 10.0.0-M1 through 10.0.0-M6, 9.0.0.M1 through 9.0.36, 8.5.0 through 8.5.56, and 7.0.27 through 7.0.104 is not validated correctly, allowing invalid lengths to trigger an infinite loop. An attacker able to send WebSocket frames to the affected server can cause a denial of service by repeatedly sending frames with invalid payload lengths.

Official description · CVE.org

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Breakdown
26.5 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 4 months after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+4 mo

A fix was bypassed or incomplete once over 8 weeks. The latest fix listed for tomcat is 10.0.5.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2020-13935The payload length in a WebSocket frame was not correctly…14 Jul 2020
  2. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textThe fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame.
    CVE-2020-14384A flaw was found in JBossWeb in versions before…9 Sep 2020

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 9.0.31CVE-2019-1756924 Feb 2020
  2. 9.0.31CVE-2020-193524 Feb 2020
  3. 10.0.0-M5CVE-2020-1199626 Jun 2020
  4. 10.0.0-M6CVE-2020-1393414 Jul 2020
  5. 10.0.0-M7CVE-2020-1393514 Jul 2020
  6. 10.0.4CVE-2021-4107916 Sep 2021
  7. 10.0.5CVE-2021-3063912 Jul 2021
  8. 10.0.5CVE-2021-3064012 Jul 2021Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

3 packages in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-m7jv-hq7h-mq7c

Upgrade to 9.0.109

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2019-0221, CVE-2020-13934, +4).

Also affected, despite being newer: 10.0.0-M1 up to 10.0.0-M7.

Set the version to 9.0.109 or later in your pom.xml or build.gradle.

First fixed in 9.0.37 for CVE-2020-13935.

Affected versions, by release line

If you runUpgrade to
10.0.0-M1 up to 10.0.0-M710.0.22first fix for this CVE: 10.0.0-M7
9.0.0.M1 up to 9.0.379.0.109first fix for this CVE: 9.0.37
8.5.0 up to 8.5.57

Still affected on this line by CVE-2025-55752 (no fix published).

8.5.82first fix for this CVE: 8.5.57
7.0.27 up to 7.0.1057.0.105

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (2)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • Mavenorg.apache.tomcat.embed:tomcat-embed-websocket
    Affected: 10.0.0-M1 up to 10.0.0-M7; 9.0.0.M1 up to 9.0.37; 8.5.0 up to 8.5.57; 7.0.27 up to 7.0.105Upgrade to 9.0.37 (older lines: 10.0.0-M7, 8.5.57, 7.0.105)
    GHSA-m7jv-hq7h-mq7c
  • Mavenorg.apache.tomcat:tomcat-websocket
    Affected: 10.0.0-M1 up to 10.0.0-M7; 9.0.0.M1 up to 9.0.37; 8.5.0 up to 8.5.57; 7.0.27 up to 7.0.105Upgrade to 9.0.37 (older lines: 10.0.0-M7, 8.5.57, 7.0.105)
    GHSA-m7jv-hq7h-mq7c

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 4 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

17 links, grouped by NVD tag

x_refsource_MISC 8

lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3Eoracle.com/security-alerts/cpuoct2020.htmloracle.com/security-alerts/cpujan2021.htmloracle.com/security-alerts/cpuApr2021.htmloracle.com//security-alerts/cpujul2021.htmloracle.com/security-alerts/cpuoct2021.htmloracle.com/security-alerts/cpujan2022.htmloracle.com/security-alerts/cpuapr2022.html

vendor-advisory 5

debian.org/security/2020/dsa-4727lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.htmllists.opensuse.org/opensuse-security-announce/2020-07/msg00088.htmlusn.ubuntu.com/4448-1/usn.ubuntu.com/4596-1/

mailing-list 2

lists.debian.org/debian-lts-announce/2020/07/msg00017.htmllists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E

x_refsource_CONFIRM 2

security.netapp.com/advisory/ntap-20200724-0003/kc.mcafee.com/corporate/index?page=content&id=SB10332
↑ ↓ chooseEnter openEsc close