Skip to content
OpenAdvisories
High DLA-2286-1 2 CVEs

tomcat8 - security update

Published Jul 22, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 tomcat8 8.5.54-0+deb9u3

Vulnerabilities 2

  • High 7.5
    CVE-2020-13934 EPSS 64%

    Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

    An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur…

    org.apache.tomcat:tomcat tomcat9 tomcat8 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2020-13935 Public exploit EPSS 87%

    Infinite Loop in Apache Tomcat

    The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…

    org.apache.tomcat:tomcat tomcat8 tomcat9 tomcat9 Debian Ubuntu Maven