CVE-2020-13935: Apache Tomcat
High severity, CVSS 7.5. EPSS: 86.6% chance of exploitation in the next 30 days.
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Affected products
- Apache Tomcat: from 7.0.27, up to and including 7.0.104; from 8.5.0, up to and including 8.5.56; from 9.0.1, up to and including 9.0.36; version 9.0.0 only; version 10.0.0 only
- Canonical Ubuntu Linux: version 16.04 only; version 20.04 only
- Debian Debian Linux: version 9.0 only; version 10.0 only
- McAfee Epolicy Orchestrator: version 5.9.0 only; version 5.9.1 only; version 5.10.0 only
- Netapp Oncommand System Manager: from 3.0.0, up to and including 3.1.3
- Opensuse Leap: version 15.1 only; version 15.2 only
- Oracle Agile Engineering Data Management: version 6.2.1.0 only
- Oracle Agile Product Lifecycle Management: version 9.3.3 only; version 9.3.5 only; version 9.3.6 only
- Oracle Blockchain Platform: before 21.1.2 (fixed in 21.1.2)
- Oracle Commerce Guided Search: version 11.3.2 only
- Oracle Communications Cloud Native Core Policy: version 1.14.0 only
- Oracle Communications Instant Messaging Server: version 10.0.1.5.0 only
- Oracle Fmw Platform: version 12.2.1.3.0 only; version 12.2.1.4.0 only
- Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
- Oracle Managed File Transfer: version 12.2.1.3.0 only; version 12.2.1.4.0 only
- Oracle MySQL Enterprise Monitor: up to and including 8.0.21
- Oracle Siebel UI Framework: up to and including 20.12
- Oracle Workload Manager: version 12.2.0.1 only; version 18c only; version 19c only
Published 2020-07-14. Last modified 2026-10-08.