Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2020-13943

CVE-2020-13943MEDIUM

n/a Apache Tomcat — If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  L  N  N    4.3   .5497   99.0     —

AFFECTED
  Product        Versions                                                                     Fixed
  Apache Tomcat  Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57 –  —

TIMELINE
  Jun 8   Reserved by apache
  Oct 12  Published (CNA: apache)
  Oct 8   ENRICHED — CVE-2020-13943 (Apache Tomcat). Received CVSS 4.3 and CPE data from NVD.

CNA: apache · CVSS v3.1 · 7 references · NVD status: Modified

Description

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 8, 2020	Reserved	Reserved by apache
October 12, 2020	Published	Published (CNA: apache)
October 8, 2026	ENRICHED	ENRICHED — CVE-2020-13943 (Apache Tomcat). Received CVSS 4.3 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	Apache Tomcat	—	Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57	—

References (7)

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html [Mailing List, Third Party Advisory]
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html [Broken Link]
https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E [Vendor Advisory]
https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html [Third Party Advisory]
https://security.netapp.com/advisory/ntap-20201016-0007/ [Third Party Advisory]
https://www.debian.org/security/2021/dsa-4835 [Third Party Advisory]
https://www.oracle.com/security-alerts/cpuApr2021.html [Patch, Third Party Advisory]

Authoritative record: CVE-2020-13943 at cve.org

About this page