CVE-2020-17527: Apache Tomcat - Exposure of Sensitive Information
Summary
CVE-2020-17527: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat. Affects org.apache.tomcat:tomcat-coyote across 3 version ranges.
>= 8.5.0, < 8.5.60
>= 9.0.0-M1, < 9.0.40
>= 10.0.0-M1, < 10.0.0-M10
Fixed in 8.5.60, 9.0.40 or 10.0.0-M10, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-17527 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications, supporting the latest Java Servlet API specifications. Apache Tomcat supports multiple versions, including 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39, and 8.5.0 to 8.5.59. This vulnerability affects these versions of Apache Tomcat.
Vulnerability Detail
The vulnerability identified as CVE-2020-17527 in Apache Tomcat allows an unauthorized actor to access sensitive information. When processing HTTP/2 requests, Apache Tomcat may reuse an HTTP request header value from a previous stream received on an HTTP/2 connection for the subsequent stream's request. Although this would typically result in an error and the closure of the HTTP/2 connection, there is a possibility of information leakage between requests. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.608.5.60 -
>= 9.0.0-M1, < 9.0.409.0.40 -
>= 10.0.0-M1, < 10.0.0-M1010.0.0-M10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to apply the recommended fix by upgrading to the patched versions of Apache Tomcat.
Conclusion
The exposure of sensitive information vulnerability in Apache Tomcat poses a significant risk to the security of web applications. It is crucial to promptly upgrade to the patched versions of Apache Tomcat to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat-coyote →
FAQ
Apache Tomcat is an open-source web server and servlet container used for hosting Java-based web applications.
The vulnerability affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39, and 8.5.0 to 8.5.59.
This vulnerability could allow an unauthorized actor to access sensitive information by reusing HTTP request header values between requests on an HTTP/2 connection.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, upgrade Apache Tomcat to version 10.0.0-M9, 9.0.39, or 8.5.59, depending on the affected version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-coyote.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
