High severity7.5NVD Advisory· Published Jul 14, 2020· Updated Jun 17, 2026

CVE-2020-13935

Description

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.tomcat:tomcatMaven	>= 10.0.0-M1, < 10.0.0-M7	10.0.0-M7
org.apache.tomcat:tomcatMaven	>= 9.0.0.M1, < 9.0.37	9.0.37
org.apache.tomcat:tomcatMaven	>= 8.5.0, < 8.5.57	8.5.57
org.apache.tomcat:tomcatMaven	>= 7.0.27, < 7.0.105	7.0.105
org.apache.tomcat.embed:tomcat-embed-websocketMaven	>= 7.0.27, < 7.0.105	7.0.105
org.apache.tomcat.embed:tomcat-embed-websocketMaven	>= 8.5.0, < 8.5.57	8.5.57
org.apache.tomcat.embed:tomcat-embed-websocketMaven	>= 9.0.0.M1, < 9.0.37	9.0.37
org.apache.tomcat.embed:tomcat-embed-websocketMaven	>= 10.0.0-M1, < 10.0.0-M7	10.0.0-M7
org.apache.tomcat:tomcat-websocketMaven	>= 10.0.0-M1, < 10.0.0-M7	10.0.0-M7
org.apache.tomcat:tomcat-websocketMaven	>= 9.0.0.M1, < 9.0.37	9.0.37
org.apache.tomcat:tomcat-websocketMaven	>= 8.5.0, < 8.5.57	8.5.57
org.apache.tomcat:tomcat-websocketMaven	>= 7.0.27, < 7.0.105	7.0.105

Affected products

106

Apache/Tomcat35 versions
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*+ 34 more
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*range: >=7.0.27,<=7.0.104
- cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
- (no CPE)range: Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, 7.0.27 to 7.0.104
McAfee/Epolicy Orchestrator11 versions
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*
NetApp/Oncommand System Manager
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*
Range: >=3.0.0,<=3.1.3
Oracle Corporation/Agile Engineering Data Management
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*
Oracle Corporation/Agile Plm3 versions
cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Oracle Corporation/Blockchain Platform
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
Range: <21.1.2
Oracle Corporation/Commerce Guided Search
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Policy
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Instant Messaging Server
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*
Oracle Corporation/Fmw Platform2 versions
cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Instantis Enterprisetrack3 versions
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
Oracle Corporation/Managed File Transfer2 versions
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Mysql Enterprise Monitor
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Range: <=8.0.21
Oracle Corporation/Siebel UI Framework
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
Range: <=20.12
Oracle Corporation/Workload Manager3 versions
cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*
Canonical/Ubuntu Linux2 versions
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*+ 1 more
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
OpenSUSE/Leap2 versions
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
osv-coords33 versions
pkg:bitnami/tomcat pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket pkg:maven/org.apache.tomcat/tomcat pkg:maven/org.apache.tomcat/tomcat-websocket pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweed pkg:rpm/suse/tomcat&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/tomcat&distro=SUSE%20Enterprise%20Storage%205 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/tomcat&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/tomcat&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/tomcat&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/tomcat&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/tomcat&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209
>= 7.0.27, < 7.0.105+ 32 more
- (no CPE)range: >= 7.0.27, < 7.0.105
- (no CPE)range: >= 7.0.27, < 7.0.105
- (no CPE)range: >= 10.0.0-M1, < 10.0.0-M7
- (no CPE)range: >= 10.0.0-M1, < 10.0.0-M7
- (no CPE)range: < 9.0.36-lp151.3.27.1
- (no CPE)range: < 9.0.36-lp152.2.4.1
- (no CPE)range: < 9.0.43-8.1
- (no CPE)range: < 10.1.14-1.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 9.0.36-3.65.2
- (no CPE)range: < 9.0.36-3.65.2
- (no CPE)range: < 9.0.36-4.41.2
- (no CPE)range: < 9.0.36-3.6.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 9.0.36-3.45.1
- (no CPE)range: < 9.0.36-3.45.1
- (no CPE)range: < 9.0.115-3.160.1
- (no CPE)range: < 9.0.36-3.65.2
- (no CPE)range: < 9.0.115-3.160.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 9.0.36-3.45.1
- (no CPE)range: < 9.0.36-3.45.1
- (no CPE)range: < 9.0.36-3.65.2
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 9.0.36-3.45.1
- (no CPE)range: < 8.0.53-29.37.1
- (no CPE)range: < 9.0.36-3.45.1

Patches

Vulnerability mechanics

References

www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuApr2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2020.htmlnvdPatchThird Party AdvisoryWEB
lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.htmlnvdMailing ListThird Party AdvisoryWEB
lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.htmlnvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-m7jv-hq7h-mq7cghsaADVISORY
kc.mcafee.com/corporate/indexnvdThird Party AdvisoryWEB
lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3EnvdMailing ListRelease NotesVendor AdvisoryWEB
lists.debian.org/debian-lts-announce/2020/07/msg00017.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-13935ghsaADVISORY
security.netapp.com/advisory/ntap-20200724-0003/nvdThird Party Advisory
usn.ubuntu.com/4448-1/nvdThird Party Advisory
usn.ubuntu.com/4596-1/nvdThird Party Advisory
www.debian.org/security/2020/dsa-4727nvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdNot ApplicableThird Party AdvisoryWEB
github.com/apache/tomcat/commit/12d715676038efbf9c728af10163f8277fc019d5ghsaWEB
github.com/apache/tomcat/commit/1c1c77b0efb667cea80b532440b44cea1dc427c3ghsaWEB
github.com/apache/tomcat/commit/40fa74c74822711ab878079d0a69f7357926723dghsaWEB
github.com/apache/tomcat/commit/4c04982870d6e730c38e21e58fb653b7cf723784ghsaWEB
github.com/apache/tomcat/commit/f9f75c14678b68633f79030ddf4ff827f014cc84ghsaWEB
lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50@%3Cusers.tomcat.apache.org%3EghsaWEB
security.netapp.com/advisory/ntap-20200724-0003ghsaWEB
tomcat.apache.org/security-10.htmlghsaWEB
tomcat.apache.org/security-7.htmlghsaWEB
tomcat.apache.org/security-8.htmlghsaWEB
tomcat.apache.org/security-9.htmlghsaWEB
usn.ubuntu.com/4448-1ghsaWEB
usn.ubuntu.com/4596-1ghsaWEB
lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.069
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000