Skip to content
OpenAdvisories
High DLA-2279-1 2 CVEs

tomcat8 - security update

Published Jul 12, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 tomcat8 8.5.54-0+deb9u2

Vulnerabilities 2

  • High 7.5
    CVE-2020-11996 Public exploit EPSS 27%

    Uncontrolled Resource Consumption in Apache Tomcat

    A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 conne…

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • High 7.0
    CVE-2020-9484 Public exploit Scanner template EPSS 56%

    Potential remote code execution in Apache Tomcat

    When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…

    tomcat9 tomcat8 tomcat9 tomcat7 Debian Ubuntu Maven