CVE-2020-1935: Potential HTTP Request Smuggling in Apache Tomcat
Summary
CVE-2020-1935: Potential HTTP request smuggling in Apache Tomcat. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
< 7.0.100
>= 8.0.0, < 8.5.51
>= 9.0.0, < 9.0.31
Fixed in 7.0.100, 8.5.51 or 9.0.31, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-1935 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running web applications and supports the Java Servlet, JavaServer Pages (JSP), and WebSocket technologies. However, versions 7.0.0 to 7.0.99, 8.5.0 to 8.5.50, and 9.0.0.M1 to 9.0.30 of Apache Tomcat are vulnerable to a potential HTTP Request Smuggling attack.
Vulnerability Detail
The vulnerability arises from the HTTP header parsing code used in Apache Tomcat. This code employs an end-of-line parsing approach that allows certain invalid HTTP headers to be parsed as valid. This flaw opens up the possibility of HTTP Request Smuggling attacks if Tomcat is situated behind a reverse proxy that mishandles the invalid Transfer-Encoding header. While the occurrence of such a reverse proxy is considered unlikely, the vulnerability remains a concern.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.0.1007.0.100 -
>= 8.0.0, < 8.5.518.5.51 -
>= 9.0.0, < 9.0.319.0.31
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if upgrading to the fixed versions is not immediately feasible, administrators can consider implementing additional security measures. One possible approach is to configure the reverse proxy in front of Apache Tomcat to explicitly reject requests with invalid Transfer-Encoding headers. This can be achieved by configuring the reverse proxy to return an error response (e.g., 400 Bad Request) when encountering such requests. Consult the documentation of the specific reverse proxy software being used for guidance on implementing this workaround.
Conclusion
The HTTP Request Smuggling vulnerability in Apache Tomcat can potentially allow attackers to manipulate requests and bypass security measures. It is crucial to upgrade to the fixed versions or implement the provided workaround to ensure the security of the web server and hosted applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container used for hosting Java-based web applications.
Versions 7.0.0 to 7.0.99, 8.5.0 to 8.5.50, and 9.0.0.M1 to 9.0.30 of Apache Tomcat are affected.
HTTP Request Smuggling is a technique where an attacker manipulates the HTTP requests to bypass security measures and perform unauthorized actions.
To fix this vulnerability, upgrade to Apache Tomcat version 7.0.100, 8.5.51, or 9.0.31. Alternatively, implement the provided workaround.
There is no known exploit for this vulnerability at the moment. However, it is important to apply the necessary fixes or workarounds to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
