CVE-2020-13934 Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

What is CVE-2020-13934?

CVE-2020-13934 is a high-severity vulnerability in Apache Tomcat, published on 14 Jul 2020.

Official description

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Weakness: CWE-476, CWE-401

Which versions are affected by CVE-2020-13934?

13 open source packages ship an affected version, including org.apache.tomcat:tomcat, tomcat and org.apache.tomcat:tomcat-coyote. It affects 14 products.

Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Netapp Oncommand System Manager, Opensuse Leap, Oracle Agile Engineering Data Management and 8 more.

How do I fix CVE-2020-13934?

Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 10.0.0-M6, 8.5.56 or 9.0.36.

Is CVE-2020-13934 being exploited?

There is no known exploitation of CVE-2020-13934 in the wild and no public exploit code.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-tomcat-2020-13934, DEBIAN-CVE-2020-13934, GHSA-vf77-8h7g-gghp, UBUNTU-CVE-2020-13934.