CVE-2020-11996: Apache Tomcat HTTP/2 Denial of Service Vulnerability Alert
Recently, Apache Tomcat issued a notice saying that an HTTP/2 Denial of Service vulnerability (CVE-2020-11996) exists on Apache Tomcat was fixed. “A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.”
Affected version
- Apache Tomcat 10.0.0-M1 to 10.0.0-M5
- Apache Tomcat 9.0.0.M1 to 9.0.35
- Apache Tomcat 8.5.0 to 8.5.55
Unaffected version
- Apache Tomcat 10.0.0-M6 or later
- Apache Tomcat 9.0.36 or later
- Apache Tomcat 8.5.56 or later
Solution
Apache Tomcat has officially released a new version to fix this vulnerability. It is recommended that affected users upgrade Tomcat to the unaffected version as soon as possible.
