CVE-2020-13934: Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
Summary
CVE-2020-13934: Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 8.5.1, < 8.5.56
>= 9.0.0.M5, < 9.0.36
>= 10.0.0-M1, < 10.0.0-M6
Fixed in 8.5.56, 9.0.36 or 10.0.0-M6, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-13934 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to execute Java servlets and render web pages that include Java Server Page coding. It provides a Java HTTP web server environment for running Java code. The vulnerability identified as CVE-2020-13934 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, and 8.5.1 to 8.5.56. This vulnerability can lead to a denial of service (DoS) attack due to an improper restriction of operations within the bounds of a memory buffer.
Vulnerability Detail
The vulnerability arises from an h2c direct connection to Apache Tomcat not releasing the HTTP/1.1 processor after upgrading to HTTP/2. If a sufficient number of such requests are made, it can result in an OutOfMemoryException, causing a denial of service. This vulnerability has a CVSS score of 7.5, indicating a high severity level. The CWE IDs associated with this vulnerability are CWE-119 and CWE-476.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.5.1, < 8.5.568.5.56 -
>= 9.0.0.M5, < 9.0.369.0.36 -
>= 10.0.0-M1, < 10.0.0-M610.0.0-M6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability identified as CVE-2020-13934 in Apache Tomcat can lead to a denial of service attack. It is crucial to upgrade to the fixed versions of Apache Tomcat to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to execute Java servlets and render web pages that include Java Server Page coding.
The vulnerability affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, and 8.5.1 to 8.5.56.
This vulnerability can lead to a denial of service (DoS) attack due to an improper restriction of operations within the bounds of a memory buffer.
This vulnerability has a CVSS score of 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
