KLA12083 DoS vulnerabilities in Apache Tomcat

DoS vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to cause denial of service.

Below is a complete list of vulnerabilities:

1. DoS vulnerability in h2c direct connection can be exploited to cause denial of service.
2. DoS vulnerability in WebSocket frame can be exploited to cause denial of service.

Original advisories

Apache Tomcat 8.5.x vulnerabilities

Apache Tomcat 9.x vulnerabilities

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apache-Tomcat

CVE list

CVE-2020-13934 critical

CVE-2020-13935 critical

Solution

Update to the latest versionTomcat 9 Software Downloads

Tomcat 8.5 Software Downloads

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• Apache Tomcat 8.5.x earlier than 8.5.57Apache Tomcat 9.x earlier than 9.0.37