Skip to content
OpenAdvisories
High DSA-4835-1 2 CVEs

tomcat9 - security update

Published Jan 22, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 tomcat9 9.0.31-1~deb10u3

Vulnerabilities 2

  • High 7.5
    CVE-2020-17527 Public exploit EPSS 25%

    Apache Tomcat: Request header mix-up between HTTP/2 streams

    While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated wi…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Azure Linux Maven
  • Medium 4.3
    CVE-2020-13943 EPSS 53%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent re…

    tomcat9 org.apache.tomcat:tomcat-coyote Debian Maven