Medium severity4.3NVD Advisory· Published Oct 12, 2020· Updated Jun 17, 2026
CVE-2020-13943
CVE-2020-13943
Description
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.tomcat:tomcat-coyoteMaven | >= 10.0.0-M1, < 10.0.0-M8 | 10.0.0-M8 |
org.apache.tomcat:tomcat-coyoteMaven | >= 9.0.0-M1, < 9.0.38 | 9.0.38 |
org.apache.tomcat:tomcat-coyoteMaven | >= 8.5.0, < 8.5.58 | 8.5.58 |
Affected products
17- osv-coords16 versionspkg:bitnami/tomcatpkg:maven/org.apache.tomcat/tomcat-coyotepkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweedpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
>= 8.5.0, < 8.5.1+ 15 more
- (no CPE)range: >= 8.5.0, < 8.5.1
- (no CPE)range: >= 10.0.0-M1, < 10.0.0-M8
- (no CPE)range: < 10.1.14-1.1
- (no CPE)range: < 9.0.36-lp151.3.33.1
- (no CPE)range: < 9.0.36-lp152.2.10.1
- (no CPE)range: < 9.0.36-8.4
- (no CPE)range: < 9.0.36-3.74.1
- (no CPE)range: < 9.0.36-3.74.1
- (no CPE)range: < 9.0.36-4.47.3
- (no CPE)range: < 9.0.36-3.12.3
- (no CPE)range: < 9.0.36-3.50.1
- (no CPE)range: < 9.0.115-3.160.1
- (no CPE)range: < 9.0.36-3.74.1
- (no CPE)range: < 9.0.36-3.50.1
- (no CPE)range: < 9.0.36-3.74.1
- (no CPE)range: < 9.0.115-3.160.1
Patches
Vulnerability mechanics
References
13- www.oracle.com/security-alerts/cpuApr2021.htmlnvdPatchThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.htmlnvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-f268-65qc-98vgghsaADVISORY
- lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3EnvdVendor AdvisoryWEB
- lists.debian.org/debian-lts-announce/2020/10/msg00019.htmlnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-13943ghsaADVISORY
- security.netapp.com/advisory/ntap-20201016-0007/nvdThird Party Advisory
- www.debian.org/security/2021/dsa-4835nvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.htmlnvdBroken LinkWEB
- github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bbghsaWEB
- github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59bghsaWEB
- github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dcb292aghsaWEB
- security.netapp.com/advisory/ntap-20201016-0007ghsaWEB
News mentions
0No linked articles in our index yet.