CVE-2020-13934: Null Pointer Dereference
A flaw was found in Apache Tomcat, where an h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests are made, an OutOfMemoryException could occur, leading to a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
A flaw was found in the Apache Tomcat, where an h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
It affects the version of Apache Tomcat 10.0.0-M1 to 10.0.0-M6, Apache Tomcat 9.0.0.M5 to 9.0.36, Apache Tomcat 8.5.1 to 8.5.56.
Upstream commits: Tomcat 10.0: https://github.com/apache/tomcat/commit/c9167ae30f3b03b112f3d81772e3450b7d0e6a25 Tomcat 9.0: https://github.com/apache/tomcat/commit/172977f04a5215128f1e278a688983dcd230f399 Tomcat 8.5: https://github.com/apache/tomcat/commit/923d834500802a61779318911d7898bd85fc950e
Reference: http://mail-archives.apache.org/modmbox/tomcat-announce/202007.mbox/%3Cad62f54e-8fd7-e326-25f1-3bdf1ffa3818%40apache.org%3E
— Red Hat
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Apache Tomcat is vulnerable to a denial of service, caused by not releasing the HTTP/1.1 processor after the upgrade to HTTP/2 in an h2c direct connection. By sending specially-crafted requests, a remote attacker could exploit this vulnerability to cause OutOfMemoryException resulting in a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-13934?
CVE-2020-13934 has been classified as a medium severity vulnerability due to the potential for denial of service from an OutOfMemoryException.
How do I fix CVE-2020-13934?
To mitigate CVE-2020-13934, upgrade to one of the fixed versions such as Apache Tomcat 8.5.57, 9.0.37, or 10.0.0.
Which versions of Apache Tomcat are affected by CVE-2020-13934?
CVE-2020-13934 affects Apache Tomcat versions from 8.5.1 to 8.5.56, and from 9.0.1 to 9.0.36.
What causes the vulnerability CVE-2020-13934?
CVE-2020-13934 is caused by an h2c direct connection not releasing the HTTP/1.1 processor after the upgrade to HTTP/2.
What impacts can CVE-2020-13934 have on my server?
If exploited, CVE-2020-13934 can lead to an OutOfMemoryException, resulting in a denial of service on the affected server.