CVE-2020-17527
Apache Tomcat: Request header mix-up between HTTP/2 streams
HIGH 7.5EPSS 24.6%
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
- Affected
- Apache Software Foundation · Apache Tomcat
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 24.62% chance of exploitation in the next 30 days, 98th percentile
- Published
- 2020-12-03
- Updated
- 2026-10-08
Proof-of-concept exploits (1)
- forse01/CVE-2020-17527-Tomcat2★ · 2021-02-09
Security advisories
- https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823…
- http://www.openwall.com/lists/oss-security/2020/12/03/3
- https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html
- https://security.gentoo.org/glsa/202012-23
- https://security.netapp.com/advisory/ntap-20201210-0003
- https://www.debian.org/security/2021/dsa-4835
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- advisories/GHSA-vvw4-rfwf-p6hx