Search for packages
| purl | pkg:alpm/archlinux/tomcat8@8.5.56-1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-qpdb-4y18-b3hf
Aliases: CVE-2020-13935 GHSA-m7jv-hq7h-mq7c |
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. |
Affected by 0 other vulnerabilities. |
|
VCID-umzc-c88f-5yck
Aliases: CVE-2020-13934 GHSA-vf77-8h7g-gghp |
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-ee8x-kzqv-b3ht | A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. |
CVE-2020-11996
GHSA-53hp-jpwq-2jgq |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-07-31T11:38:11.033981+00:00 | Arch Linux Importer | Fixing | VCID-ee8x-kzqv-b3ht | https://security.archlinux.org/AVG-1197 | 37.0.0 |
| 2025-07-31T11:36:48.271891+00:00 | Arch Linux Importer | Affected by | VCID-umzc-c88f-5yck | https://security.archlinux.org/AVG-1204 | 37.0.0 |
| 2025-07-31T11:36:48.244687+00:00 | Arch Linux Importer | Affected by | VCID-qpdb-4y18-b3hf | https://security.archlinux.org/AVG-1204 | 37.0.0 |