High DLA-2495-1 1 CVE

tomcat8 - security update

Published Dec 16, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	tomcat8	8.5.54-0+deb9u5

Vulnerabilities 1

High 7.5

CVE-2020-17527 Public exploit EPSS 25%

Apache Tomcat: Request header mix-up between HTTP/2 streams

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated wi…

Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Azure Linux Maven

Dec 3, 2020