VYPR
← All advisories
High severityNVD Advisory· Published Dec 3, 2020· Updated Feb 13, 2025

Apache Tomcat: Request header mix-up between HTTP/2 streams

CVE-2020-17527

Description

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Tomcat HTTP/2 connections could leak request header values between streams, potentially exposing sensitive data across requests.

Vulnerability

Overview

CVE-2020-17527 is an information disclosure vulnerability in Apache Tomcat's HTTP/2 implementation. The root cause is that Tomcat could incorrectly reuse an HTTP request header value from a previous stream on the same HTTP/2 connection for the request associated with the subsequent stream [1][2][3]. This flaw affects Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39, and 8.5.0 to 8.5.59 [4].

Exploitation

Conditions

An attacker must be able to send HTTP/2 requests to an affected Tomcat server. While the reuse of header values would most likely cause an error and force the closure of the HTTP/2 connection, it is possible that the leaked header value could be observed by the attacker before the connection is terminated [4]. No authentication is required if the HTTP/2 connector is exposed to untrusted clients.

Impact

If successfully exploited, an attacker could obtain header values from other requests processed on the same HTTP/2 connection. This could include sensitive information such as authentication tokens, session cookies, or custom headers, leading to further compromise of the application or user accounts [4].

Mitigation

Apache has released fixed versions: Tomcat 10.0.0-M10+, 9.0.40+, and 8.5.60+ [1][2][3]. Users should upgrade immediately. No workarounds are documented; the only remediation is to apply the patch. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.

References
  1. Apache Tomcat® - Apache Tomcat 9 vulnerabilities
  2. Apache Tomcat® - Apache Tomcat 8 vulnerabilities
  3. Apache Tomcat® - Apache Tomcat 10 vulnerabilities
  4. NVD - CVE-2020-17527

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcat-coyoteMaven
>= 10.0.0-M1, < 10.0.0-M1010.0.0-M10
org.apache.tomcat:tomcat-coyoteMaven
>= 9.0.0-M1, < 9.0.409.0.40
org.apache.tomcat:tomcat-coyoteMaven
>= 8.5.0, < 8.5.608.5.60

Affected products

21

Patches

3
21e3408671aa

Fix BZ 64830 - concurrency issue in HPACK decoder

https://github.com/apache/tomcatMark ThomasNov 9, 2020via ghsa
commit
2 files changed · +7 −8
  • java/org/apache/coyote/http2/HpackDecoder.java+4 −8 modified
    @@ -72,8 +72,6 @@ public class HpackDecoder {
     private volatile boolean countedCookie;
     private volatile int headerSize = 0;
 
-    private final StringBuilder stringBuilder = new StringBuilder();
-
     public HpackDecoder(int maxMemorySize) {
         this.maxMemorySizeHard = maxMemorySize;
         this.maxMemorySizeSoft = maxMemorySize;
@@ -222,19 +220,17 @@ private String readHpackString(ByteBuffer buffer) throws HpackException {
         if (huffman) {
             return readHuffmanString(length, buffer);
         }
+        StringBuilder stringBuilder = new StringBuilder(length);
         for (int i = 0; i < length; ++i) {
             stringBuilder.append((char) buffer.get());
         }
-        String ret = stringBuilder.toString();
-        stringBuilder.setLength(0);
-        return ret;
+        return stringBuilder.toString();
     }
 
     private String readHuffmanString(int length, ByteBuffer buffer) throws HpackException {
+        StringBuilder stringBuilder = new StringBuilder(length);
         HPackHuffman.decode(buffer, length, stringBuilder);
-        String ret = stringBuilder.toString();
-        stringBuilder.setLength(0);
-        return ret;
+        return stringBuilder.toString();
     }
 
     private String handleIndexedHeaderName(int index) throws HpackException {
  • webapps/docs/changelog.xml+3 −0 modified
    @@ -103,6 +103,9 @@
         Add additional debug logging for I/O issues when communicating with the
         user agent. (markt)
       </add>
+      <fix>
+        <bug>64830</bug>: Fix concurrency issue in HPACK decoder. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="WebSocket">
8d2fe6894d6e

Fix BZ 64830 - concurrency issue in HPACK decoder

https://github.com/apache/tomcatMark ThomasNov 9, 2020via ghsa
commit
2 files changed · +7 −8
  • java/org/apache/coyote/http2/HpackDecoder.java+4 −8 modified
    @@ -72,8 +72,6 @@ public class HpackDecoder {
     private volatile boolean countedCookie;
     private volatile int headerSize = 0;
 
-    private final StringBuilder stringBuilder = new StringBuilder();
-
     HpackDecoder(int maxMemorySize) {
         this.maxMemorySizeHard = maxMemorySize;
         this.maxMemorySizeSoft = maxMemorySize;
@@ -222,19 +220,17 @@ private String readHpackString(ByteBuffer buffer) throws HpackException {
         if (huffman) {
             return readHuffmanString(length, buffer);
         }
+        StringBuilder stringBuilder = new StringBuilder(length);
         for (int i = 0; i < length; ++i) {
             stringBuilder.append((char) buffer.get());
         }
-        String ret = stringBuilder.toString();
-        stringBuilder.setLength(0);
-        return ret;
+        return stringBuilder.toString();
     }
 
     private String readHuffmanString(int length, ByteBuffer buffer) throws HpackException {
+        StringBuilder stringBuilder = new StringBuilder(length);
         HPackHuffman.decode(buffer, length, stringBuilder);
-        String ret = stringBuilder.toString();
-        stringBuilder.setLength(0);
-        return ret;
+        return stringBuilder.toString();
     }
 
     private String handleIndexedHeaderName(int index) throws HpackException {
  • webapps/docs/changelog.xml+3 −0 modified
    @@ -132,6 +132,9 @@
         Add additional debug logging for I/O issues when communicating with the
         user agent. (markt)
       </add>
+      <fix>
+        <bug>64830</bug>: Fix concurrency issue in HPACK decoder. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">
d56293f816d6

Fix BZ 64830 - concurrency issue in HPACK decoder

https://github.com/apache/tomcatMark ThomasNov 9, 2020via ghsa
commit
2 files changed · +7 −8
  • java/org/apache/coyote/http2/HpackDecoder.java+4 −8 modified
    @@ -72,8 +72,6 @@ public class HpackDecoder {
     private volatile boolean countedCookie;
     private volatile int headerSize = 0;
 
-    private final StringBuilder stringBuilder = new StringBuilder();
-
     HpackDecoder(int maxMemorySize) {
         this.maxMemorySizeHard = maxMemorySize;
         this.maxMemorySizeSoft = maxMemorySize;
@@ -222,19 +220,17 @@ private String readHpackString(ByteBuffer buffer) throws HpackException {
         if (huffman) {
             return readHuffmanString(length, buffer);
         }
+        StringBuilder stringBuilder = new StringBuilder(length);
         for (int i = 0; i < length; ++i) {
             stringBuilder.append((char) buffer.get());
         }
-        String ret = stringBuilder.toString();
-        stringBuilder.setLength(0);
-        return ret;
+        return stringBuilder.toString();
     }
 
     private String readHuffmanString(int length, ByteBuffer buffer) throws HpackException {
+        StringBuilder stringBuilder = new StringBuilder(length);
         HPackHuffman.decode(buffer, length, stringBuilder);
-        String ret = stringBuilder.toString();
-        stringBuilder.setLength(0);
-        return ret;
+        return stringBuilder.toString();
     }
 
     private String handleIndexedHeaderName(int index) throws HpackException {
  • webapps/docs/changelog.xml+3 −0 modified
    @@ -128,6 +128,9 @@
         Add additional debug logging for I/O issues when communicating with the
         user agent. (markt)
       </add>
+      <fix>
+        <bug>64830</bug>: Fix concurrency issue in HPACK decoder. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

49

News mentions

0

No linked articles in our index yet.