CVE-2020-11996: Apache Tomcat HTTP/2 Denial of Service Vulnerability Alert

by ·

Recently, Apache Tomcat issued a notice saying that an HTTP/2 Denial of Service vulnerability (CVE-2020-11996) exists on Apache Tomcat was fixed. “A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.”

Apache Tomcat 9

Affected version

  • Apache Tomcat 10.0.0-M1 to 10.0.0-M5
  • Apache Tomcat 9.0.0.M1 to 9.0.35
  • Apache Tomcat 8.5.0 to 8.5.55

Unaffected version

  • Apache Tomcat 10.0.0-M6 or later
  • Apache Tomcat 9.0.36 or later
  • Apache Tomcat 8.5.56 or later

Solution

Apache Tomcat has officially released a new version to fix this vulnerability. It is recommended that affected users upgrade Tomcat to the unaffected version as soon as possible.

Tags: