Description
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache | Apache Tomcat | Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50, 7.0.0 to 7.0.99 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tomcat9 | 9.0.31-1 | — |
| Debian 13 | tomcat9 | 9.0.31-1 | — |
| Debian 12 | tomcat9 | 9.0.31-1 | — |
| Debian 10 | tomcat9 | 9.0.31-1~deb10u1 | DSA-4680-1 |
| Debian 9 | tomcat8 | 8.5.54-0+deb9u1 | DSA-4673-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | tomcat7 | 7.0.56-3+really7.0.100-1 | DLA-2133-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u17 | DLA-2209-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.13 | USN-4448-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | tomcat8 +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | tomcat7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | tomcat7 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2020:4847 |
| RHEL 8 | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jackson-core +2 | 2.10.0-1.module+el8.2.0+5059+3eb3af25 | RHSA-2020:4847 |
| RHEL 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module+el8.1.0+3832+9784644d | RHSA-2020:4847 |
| RHEL 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jss +1 | 4.7.3-1.module+el8.3.0+8058+d5cd4219 | RHSA-2020:4847 |
| RHEL 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2020:4847 |
| RHEL 8 | pki-ca +8 | 10.9.4-1.module+el8.3.0+8058+d5cd4219 | RHSA-2020:4847 |
| RHEL 8 | pki-servlet-engine +1 | 1:9.0.30-1.module+el8.3.0+6730+8f9c6254 | RHSA-2020:4847 |
| RHEL 8 | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | resteasy | 3.0.26-3.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | tomcatjss | 7.5.0-1.module+el8.3.0+7355+c59bcbd9 | RHSA-2020:4847 |
| RHEL 8 | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 7 | tomcat +9 | 7.0.76-16.el7_9 | RHSA-2020:5020 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.7 EUS | tomcat +9 | 7.0.76-12.el7_7 | RHSA-2021:1030 |
| RHEL 7.6 EUS | tomcat +9 | 7.0.76-11.el7_6 | RHSA-2021:0882 |
| Red Hat JBoss Web Server 5 | jws5-tomcat +9 | 9.0.30-3.redhat_4.1.el6jws | RHSA-2020:1520 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-native | 1.2.23-4.redhat_4.el6jws | RHSA-2020:1520 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-41.ep7.el6 | RHSA-2020:3303 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-45.ep7.el6 | RHSA-2020:3303 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | apache-commons-net | 3.6-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | bea-stax | 1.2.0-16.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-jaxb | 2.2.11-11.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-core +2 | 2.10.0-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-jaxrs-providers | 2.9.9-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | javassist | 3.18.1-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | ldapjdk | 4.22.0-1.module+el8.4.0+418+b7ae1d4a | RLSA-2020:4847 |
| Rocky Linux 8 | pki-servlet-engine | 1:9.0.30-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | python-nss | 1.0.1-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | velocity | 1.7-24.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | tomcat | 9.0.31-4.22.1 | SUSE-SU-2020:0631-1 |
| SLES 15 | tomcat | 9.0.31-3.42.2 | SUSE-SU-2020:0598-1 |
| SLES 12 SP5 | tomcat | 9.0.31-3.25.1 | SUSE-SU-2020:0632-1 |
| SLES 12 SP4 | tomcat | 9.0.31-3.25.1 | SUSE-SU-2020:0632-1 |
| SLES 12 SP3 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
| SLES for SAP 15 | tomcat | 9.0.31-3.42.2 | SUSE-SU-2020:0598-1 |
| SLES for SAP 12 SP5 | tomcat | 9.0.31-3.25.1 | SUSE-SU-2020:0632-1 |
| SLES for SAP 12 SP4 | tomcat | 9.0.31-3.25.1 | SUSE-SU-2020:0632-1 |
| SLES for SAP 12 SP3 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
| SLES for SAP 12 SP2 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
| SLE HPC 15 | tomcat | 9.0.31-3.42.2 | SUSE-SU-2020:0598-1 |
| SUSE OpenStack Cloud Crowbar 8 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
| SUSE OpenStack Cloud 8 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
| SUSE OpenStack Cloud 7 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
| SUSE HPE Helion OpenStack 8 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
| SUSE Enterprise Storage 5 | tomcat | 8.0.53-29.37.1 | SUSE-SU-2020:2611-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 9.0.36-8.4 | openSUSE-SU-2024:11468-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
| openSUSE Leap 15.1 | tomcat | 9.0.31-lp151.3.12.1 | openSUSE-SU-2020:0345-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | tomcat +9 | 7.0.76-10.amzn2.0.6 | ALAS2-2023-2216 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | tomcat +9 | 7.0.76-16.el7_9 | ELSA-2020-5020 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | < 7.0.100 | 7.0.100 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat:tomcat | >= 8.0.0, < 8.5.51 | 8.5.51 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat:tomcat | >= 9.0.0, < 9.0.31 | 9.0.31 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | < 7.0.100 | 7.0.100 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 8.0.0, < 8.5.51 | 8.5.51 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 9.0.0, < 9.0.31 | 9.0.31 | GHSA-qxf4-chvg-4r8r |
Advisories 24
- RHSA-2020:4847 Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2021:1030 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:0882 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:5020 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:3303 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 10 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:1520 Red Hat Security Advisory: Red Hat JBoss Web Server 5.3 release Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-4448-1 tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4673-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4680-1 tomcat9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2133-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2209-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2020:4847 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2020:0632-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:2611-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0598-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0345-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0631-1 Security update for tomcat SUSE / openSUSE Security Updates · May 2, 2025
- NCSC-2025-0123 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- WID-SEC-2023-2130 Apache Tomcat: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2023
- ALAS2-2023-2216 Moderate: tomcat security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 23, 2023
- ELSA-2020-5020 Low: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 12, 2020
References
- [tomcat-announce] 20200224 [SECURITY] CVE-2020-1935 HTTP Request Smuggling mailing-list
- [debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update mailing-list
- openSUSE-SU-2020:0345 vendor-advisory
- [tomee-commits] 20200320 [jira] [Created] (TOMEE-2790) TomEE plus(7.0.7) is affected by CVE-2020-1935 & CVE-2019-17569 vulnerabilities mailing-list
- [tomee-commits] 20200323 [jira] [Commented] (TOMEE-2790) TomEE plus(7.0.7) is affected by CVE-2020-1935 & CVE-2019-17569 vulnerabilities mailing-list
- DSA-4673 vendor-advisory
- DSA-4680 vendor-advisory
- [debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.netapp.com/advisory/ntap-20200327-0005/
- [tomcat-users] 20200724 CVE-2020-1935 mailing-list
- [tomcat-users] 20200724 Re: CVE-2020-1935 mailing-list
- [tomcat-users] 20200724 RE: CVE-2020-1935 mailing-list
- [tomcat-users] 20200726 Re: CVE-2020-1935 mailing-list
- [tomcat-users] 20200727 RE: CVE-2020-1935 mailing-list
- USN-4448-1 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- [tomcat-dev] 20210428 [Bug 65272] Problems proccessing HTTP request without CR in last versions mailing-list