CVE-2020-17527: Apache Tomcat

High severity, CVSS 7.5. EPSS: 24.6% chance of exploitation in the next 30 days.

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

Affected products

• Apache Tomcat: from 8.5.1, up to and including 8.5.59; from 9.0.1, up to and including 9.0.35; version 9.0.0 only; version 9.0.35-3.39.1 only; version 9.0.35-3.57.3 only; version 9.0.36 only; …
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Netapp Element Plug-In: affected versions not specified
• Netapp Oncommand System Manager: from 3.0.0, up to and including 3.1.3
• Oracle Blockchain Platform: before 21.1.2 (fixed in 21.1.2)
• Oracle Communications Cloud Native Core Binding Support Function: version 1.10.0 only
• Oracle Communications Cloud Native Core Policy: version 1.14.0 only
• Oracle Communications Instant Messaging Server: version 10.0.1.5.0 only
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Oracle MySQL Enterprise Monitor: before 8.0.23 (fixed in 8.0.23)
• Oracle SD-WAN Edge: version 9.0 only
• Oracle Workload Manager: version 18c only; version 19c only

Published 2020-12-03. Last modified 2026-10-08.