CVE-2020-13943
Mediumtomcat8 - security update
Published May 5, 2021 · Updated Oct 10, 2026 · Also known as BIT-tomcat-2020-13943, DEBIAN-CVE-2020-13943, DLA-2407-1, DSA-4835-1, GHSA-f268-65qc-98vg, SUSE-SU-2020:2996-1, SUSE-SU-2020:3068-1, SUSE-SU-2020:3069-1, SUSE-SU-2021:0040-1, TR-21-0062
Key Facts
Patch immediately- CVE-2020-13943 is a medium-severity vulnerability (CVSS 4.3 v3.1) affecting Tomcat (Apache), Instantis Enterprisetrack (Oracle), SD-WAN Edge (Oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 55% probability of exploitation in the next 30 days.
- Fixed versions are available, including Apache Tomcat 8.5.51-5.ph1, Apache Tomcat 8.5.51-5.ph2, Apache Tomcat 8.5.51-5.ph3.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS (30-day exploit likelihood)
55%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-13943 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Affected Products
284 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | 10.0.0-milestone1, 10.0.0-milestone2, 10.0.0-milestone3, 10.0.0-milestone4, 10.0.0-milestone5, 10.0.0-milestone6, 10.0.0-milestone7, 8.5.0 | 8.5.1 |
| Instantis EnterprisetrackOracle | 17.1, 17.2, 17.3 | n/a |
| SD-WAN EdgeOracle | 9.0 | n/a |
| Debian LinuxDebian | 10.0, 9.0 | n/a |
| tomcat8debian | See advisory | 8.5.54-0+deb9u4 |
Patched Releases
Apache Tomcat
8.5.51-5.ph1, 8.5.51-5.ph2, 8.5.51-5.ph3
jws5-tomcat
0:9.0.36-9.redhat_8.1.el7jws, 0:9.0.36-9.redhat_8.1.el8jws
jws5-tomcat-native
0:1.2.25-3.redhat_3.el7jws, 0:1.2.25-3.redhat_3.el8jws
org.apache.tomcat:tomcat-coyote
10.0.0-M8, 8.5.58, 9.0.38
Tomcat
8.5.1, 8.5.10, 8.5.11, 8.5.12, 8.5.13, 8.5.14, 8.5.15, 8.5.16, 8.5.17, 8.5.18, 8.5.19, 8.5.2, 8.5.20, 8.5.21, 8.5.22, 8.5.23, 8.5.24, 8.5.25, 8.5.26, 8.5.27, 8.5.28, 8.5.29, 8.5.3, 8.5.30, 8.5.31, 8.5.32, 8.5.33, 8.5.34, 8.5.35, 8.5.36, 8.5.37, 8.5.38, 8.5.39, 8.5.4, 8.5.40, 8.5.41, 8.5.42, 8.5.43, 8.5.44, 8.5.45, 8.5.46, 8.5.47, 8.5.48, 8.5.49, 8.5.5, 8.5.50, 8.5.51, 8.5.52, 8.5.53, 8.5.54, 8.5.55, 8.5.56, 8.5.57, 8.5.58, 8.5.6, 8.5.7, 8.5.8, 8.5.9, 9.0.115-3.160.1, 9.0.36-3.12.3, 9.0.36-3.50.1, 9.0.36-3.74.1, 9.0.36-4.47.3, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1, 9.0.38
tomcat-admin-webapps
9.0.115-3.160.1, 9.0.36-3.12.3, 9.0.36-3.50.1, 9.0.36-3.74.1, 9.0.36-4.47.3, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-docs-webapp
9.0.115-3.160.1, 9.0.36-3.50.1, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-el-3_0-api
9.0.115-3.160.1, 9.0.36-3.12.3, 9.0.36-3.50.1, 9.0.36-3.74.1, 9.0.36-4.47.3, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-embed
9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-javadoc
9.0.115-3.160.1, 9.0.36-3.50.1, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-jsp-2_3-api
9.0.115-3.160.1, 9.0.36-3.12.3, 9.0.36-3.50.1, 9.0.36-3.74.1, 9.0.36-4.47.3, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-jsvc
9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-lib
9.0.115-3.160.1, 9.0.36-3.12.3, 9.0.36-3.50.1, 9.0.36-3.74.1, 9.0.36-4.47.3, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-servlet-4_0-api
9.0.115-3.160.1, 9.0.36-3.12.3, 9.0.36-3.50.1, 9.0.36-3.74.1, 9.0.36-4.47.3, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat-webapps
9.0.115-3.160.1, 9.0.36-3.12.3, 9.0.36-3.50.1, 9.0.36-3.74.1, 9.0.36-4.47.3, 9.0.36-8.4, 9.0.36-lp151.3.33.1, 9.0.36-lp152.2.10.1
tomcat10
10.1.14-1.1
tomcat10-admin-webapps
10.1.14-1.1
tomcat10-doc
10.1.14-1.1
tomcat10-docs-webapp
10.1.14-1.1
tomcat10-el-5_0-api
10.1.14-1.1
tomcat10-embed
10.1.14-1.1
tomcat10-jsp-3_1-api
10.1.14-1.1
tomcat10-jsvc
10.1.14-1.1
tomcat10-lib
10.1.14-1.1
tomcat10-servlet-6_0-api
10.1.14-1.1
Timeline
Publicly disclosed
May 5, 2021
Last updated
Oct 10, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6708
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5237
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17195
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
FAQ
Common Questions.
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - i…
Affected: Tomcat (Apache) versions 10.0.0-milestone1, 10.0.0-milestone2, 10.0.0-milestone3, 10.0.0-milestone4, 10.0.0-milestone5, 10.0.0-milestone6, 10.0.0-milestone7, 8.5.0; Instantis Enterprisetrack (Oracle) versions 17.1, 17.2, 17.3; SD-WAN Edge (Oracle) versions 9.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Apache Tomcat 8.5.51-5.ph1, Apache Tomcat 8.5.51-5.ph2, Apache Tomcat 8.5.51-5.ph3.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-13943 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo