VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Oct 12, 2020· Updated Jun 17, 2026

CVE-2020-13943

CVE-2020-13943

Description

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcat-coyoteMaven
>= 10.0.0-M1, < 10.0.0-M810.0.0-M8
org.apache.tomcat:tomcat-coyoteMaven
>= 9.0.0-M1, < 9.0.389.0.38
org.apache.tomcat:tomcat-coyoteMaven
>= 8.5.0, < 8.5.588.5.58

Affected products

148
  • Apache/Tomcat126 versions
    cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*+ 125 more
    • cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.16:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.17:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.18:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.19:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.20:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.21:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.22:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.23:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.24:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.25:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.26:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.27:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.28:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.29:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.30:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.31:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.32:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.33:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.34:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.35:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.36:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.37:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.38:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.39:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.40:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.41:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.42:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.43:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.44:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.45:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.46:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.47:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.48:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.49:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.50:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.51:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.52:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.53:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.54:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.55:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.56:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.57:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.18:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.19:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.20:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.21:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.22:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.23:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.24:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.25:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.26:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.27:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.28:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.29:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.30:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.31:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.32:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.33:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.35:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.9:*:*:*:*:*:*:*
    • (no CPE)range: Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57
  • Oracle Corporation/Instantis Enterprisetrack3 versions
    cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
  • Oracle Corporation/Sd Wan Edge
    cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*
  • Debian/linux2 versions
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • osv-coords16 versions
    pkg:bitnami/tomcatpkg:maven/org.apache.tomcat/tomcat-coyotepkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweedpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015
    >= 8.5.0, < 8.5.1+ 15 more
    • (no CPE)range: >= 8.5.0, < 8.5.1
    • (no CPE)range: >= 10.0.0-M1, < 10.0.0-M8
    • (no CPE)range: < 9.0.36-lp151.3.33.1
    • (no CPE)range: < 9.0.36-lp152.2.10.1
    • (no CPE)range: < 9.0.36-8.4
    • (no CPE)range: < 10.1.14-1.1
    • (no CPE)range: < 9.0.36-3.74.1
    • (no CPE)range: < 9.0.36-3.74.1
    • (no CPE)range: < 9.0.36-4.47.3
    • (no CPE)range: < 9.0.36-3.12.3
    • (no CPE)range: < 9.0.36-3.50.1
    • (no CPE)range: < 9.0.115-3.160.1
    • (no CPE)range: < 9.0.36-3.74.1
    • (no CPE)range: < 9.0.115-3.160.1
    • (no CPE)range: < 9.0.36-3.50.1
    • (no CPE)range: < 9.0.36-3.74.1

Patches

Vulnerability mechanics

References

13

News mentions

0

No linked articles in our index yet.