Uncontrolled Resource Consumption in Apache Tomcat
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-11996US | high7.5 | Exploit | ||
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several second… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.htmlWEB
- https://github.com/apache/tomcatPACKAGE
- https://github.com/apache/tomcat/commit/9434a44d3449d620b1be70206819f8275b4a7509WEB
- https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b0c976WEB
- https://github.com/apache/tomcat/commit/c8acd2ab7371e39aeca7c306f3b5380f00afe552WEB
- https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79@%3Cusers.tomcat.apache.org%3EWEB
- https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd@%3Cnotifications.ofbiz.apache.org%3EWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan