cbcvebase.
CVE-2020-11996
published 2020-06-26

CVE-2020-11996: A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU…

high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Affected

21 ranges
VendorProductVersion rangeFixed in
apacheapache_tomcat
apacheapache_tomcat
apacheapache_tomcat
apachetomcat
apachetomcat
apachetomcat
apachetomcat8.5.0 – 8.5.55
apachetomcat9.0.0 – 9.0.35
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debiantomcat9< tomcat9 9.0.36-1 (bookworm)tomcat9 9.0.36-1 (bookworm)
netapponcommand_system_manager
netapponcommand_system_manager
opensuseleap
opensuseleap
oraclemysql_enterprise_monitor<= 8.0.21
oraclesiebel_ui_framework<= 20.12
oracleworkload_manager
oracleworkload_manager
oracleworkload_manager

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH