Denial Of Service (DoS)

2020-07-1508:18:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.148 Low

EPSS

Percentile

95.8%

JSON

apache tomcat is vulnerable to denial of service. An infinite loop to occurs when invalid payload lengths are parsed. An attacker is able to cause a denial of service condition in the application via malicious WebSocket frames with invalid payload lengths.

CPENameOperatorVersion
tomcat-websocketle10.0.0-M6
tomcat-websocketle8.5.56
tomcat-websocketle9.0.36
tomcat7-websocketle7.0.104
tomcat-embed-websocketle9.0.36
tomcat-embed-websocketle8.5.56
tomcat-embed-websocketle10.0.0-M6
jws5-tomcateq9.0.30__4.redhat_5.1.el7jws
jws5-tomcateq9.0.30__3.redhat_4.1.el8jws
jws5-tomcateq9.0.7__17.redhat_16.1.el7jws

Name	Operator	Version
tomcat-websocket	le	10.0.0-M6
tomcat-websocket	le	8.5.56
tomcat-websocket	le	9.0.36
tomcat7-websocket	le	7.0.104
tomcat-embed-websocket	le	9.0.36
tomcat-embed-websocket	le	8.5.56
tomcat-embed-websocket	le	10.0.0-M6
jws5-tomcat	eq	9.0.30__4.redhat_5.1.el7jws
jws5-tomcat	eq	9.0.30__3.redhat_4.1.el8jws
jws5-tomcat	eq	9.0.7__17.redhat_16.1.el7jws