Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/jws5-tomcat@9.0.30-5.redhat_6.1?arch=el8jws
purl pkg:rpm/redhat/jws5-tomcat@9.0.30-5.redhat_6.1?arch=el8jws
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 10.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-dzan-r49k-kqab
Aliases:
CVE-2020-13934
GHSA-vf77-8h7g-gghp
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. There are no reported fixed by versions.
VCID-nvbx-q971-skgm
Aliases:
CVE-2020-13935
GHSA-m7jv-hq7h-mq7c
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T14:05:47.147740+00:00 RedHat Importer Affected by VCID-dzan-r49k-kqab https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13934.json 38.0.0
2026-04-01T14:05:46.515822+00:00 RedHat Importer Affected by VCID-nvbx-q971-skgm https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13935.json 38.0.0