Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-wgsc-dnn1-ukeq
Vulnerability ID VCID-wgsc-dnn1-ukeq
Aliases CVE-2020-13943
GHSA-f268-65qc-98vg
Summary If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
cvssv3.1 4.3 http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
cvssv3.1 4.3 http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13943.json
epss 0.09572 https://api.first.org/data/v1/epss?cve=CVE-2020-13943
epss 0.09572 https://api.first.org/data/v1/epss?cve=CVE-2020-13943
epss 0.09572 https://api.first.org/data/v1/epss?cve=CVE-2020-13943
epss 0.09572 https://api.first.org/data/v1/epss?cve=CVE-2020-13943
epss 0.09572 https://api.first.org/data/v1/epss?cve=CVE-2020-13943
epss 0.09572 https://api.first.org/data/v1/epss?cve=CVE-2020-13943
epss 0.09572 https://api.first.org/data/v1/epss?cve=CVE-2020-13943
apache_tomcat Moderate https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13943
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-f268-65qc-98vg
cvssv3.1 4.3 https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb
generic_textual MODERATE https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb
cvssv3.1 4.3 https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b
generic_textual MODERATE https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b
cvssv3.1 4.3 https://github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dcb292a
generic_textual MODERATE https://github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dcb292a
cvssv3.1 4.3 https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
cvssv3.1 4.3 https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2020-13943
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-13943
cvssv3.1 4.3 https://security.netapp.com/advisory/ntap-20201016-0007
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20201016-0007
cvssv3.1 4.3 https://www.debian.org/security/2021/dsa-4835
generic_textual MODERATE https://www.debian.org/security/2021/dsa-4835
cvssv3.1 4.3 https://www.oracle.com/security-alerts/cpuApr2021.html
generic_textual MODERATE https://www.oracle.com/security-alerts/cpuApr2021.html
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13943.json
https://api.first.org/data/v1/epss?cve=CVE-2020-13943
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb
https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b
https://github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dcb292a
https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html
https://security.netapp.com/advisory/ntap-20201016-0007
https://security.netapp.com/advisory/ntap-20201016-0007/
https://www.debian.org/security/2021/dsa-4835
https://www.oracle.com/security-alerts/cpuApr2021.html
1887648 https://bugzilla.redhat.com/show_bug.cgi?id=1887648
CVE-2020-13943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13943
CVE-2020-13943 https://nvd.nist.gov/vuln/detail/CVE-2020-13943
GHSA-f268-65qc-98vg https://github.com/advisories/GHSA-f268-65qc-98vg
RHSA-2021:0494 https://access.redhat.com/errata/RHSA-2021:0494
RHSA-2021:0495 https://access.redhat.com/errata/RHSA-2021:0495
RHSA-2021:4012 https://access.redhat.com/errata/RHSA-2021:4012
RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
USN-5360-1 https://usn.ubuntu.com/5360-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13943.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dcb292a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-13943
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://security.netapp.com/advisory/ntap-20201016-0007
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://www.debian.org/security/2021/dsa-4835
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://www.oracle.com/security-alerts/cpuApr2021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.92838
EPSS Score 0.09572
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:38:06.511582+00:00 Apache Tomcat Importer Import https://tomcat.apache.org/security-10.html 38.0.0