CVE-2020-13935 Infinite Loop in Apache Tomcat
Attackers can cause a denial of service in Apache Tomcat by sending WebSocket frames with invalid payload lengths, triggering an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13935?
CVE-2020-13935 is a high-severity denial of service vulnerability in Apache Tomcat, published on 14 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Weakness: CWE-835
Which versions are affected by CVE-2020-13935?
25 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-websocket, tomcat and org.apache.tomcat:tomcat. It affects 18 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-websocket Maven | From 10.0.0-M1 | 10.0.0-M7 |
org.apache.tomcat.embed:tomcat-embed-websocket Maven | From 10.0.0-M1 | 10.0.0-M7 |
org.apache.tomcat.embed:tomcat-embed-websocket Maven | From 7.0.27 | 7.0.105 |
org.apache.tomcat.embed:tomcat-embed-websocket Maven | From 7.0.27 | 7.0.105 |
org.apache.tomcat.embed:tomcat-embed-websocket Maven | From 8.5.0 | 8.5.57 |
org.apache.tomcat.embed:tomcat-embed-websocket Maven | From 8.5.0 | 8.5.57 |
19 more packages
org.apache.tomcat.embed:tomcat-embed-websocket Maven | From 9.0.0.M1 | 9.0.37 |
org.apache.tomcat.embed:tomcat-embed-websocket Maven | From 9.0.0.M1 | 9.0.37 |
tomcat Bitnami | From 7.0.27 | 7.0.105, 8.5.57, 9.0.37 |
org.apache.tomcat:tomcat Maven | From 10.0.0-M1 | 10.0.0-M7 |
org.apache.tomcat:tomcat Maven | From 10.0.0-M1 | 10.0.0-M7 |
org.apache.tomcat:tomcat Maven | From 7.0.27 | 7.0.105 |
org.apache.tomcat:tomcat Maven | From 7.0.27 | 7.0.105 |
org.apache.tomcat:tomcat Maven | From 8.5.0 | 8.5.57 |
org.apache.tomcat:tomcat Maven | From 8.5.0 | 8.5.57 |
org.apache.tomcat:tomcat Maven | From 9.0.0.M1 | 9.0.37 |
org.apache.tomcat:tomcat Maven | From 9.0.0.M1 | 9.0.37 |
org.apache.tomcat:tomcat-websocket Maven | From 10.0.0-M1 | 10.0.0-M7 |
org.apache.tomcat:tomcat-websocket Maven | From 10.0.0-M1 | 10.0.0-M7 |
org.apache.tomcat:tomcat-websocket Maven | From 7.0.27 | 7.0.105 |
org.apache.tomcat:tomcat-websocket Maven | From 7.0.27 | 7.0.105 |
org.apache.tomcat:tomcat-websocket Maven | From 8.5.0 | 8.5.57 |
org.apache.tomcat:tomcat-websocket Maven | From 8.5.0 | 8.5.57 |
org.apache.tomcat:tomcat-websocket Maven | From 9.0.0.M1 | 9.0.37 |
org.apache.tomcat:tomcat-websocket Maven | From 9.0.0.M1 | 9.0.37 |
Linux distribution packages (3)
jbossweb Red Hat:jboss_enterprise_application_platform:6::el5 | All versions | 0:7.5.31-2.Final_redhat_2.1.ep6.el5 |
jbossweb Red Hat:jboss_enterprise_application_platform:6::el6 | All versions | 0:7.5.31-2.Final_redhat_2.1.ep6.el6 |
jbossweb Red Hat:jboss_enterprise_application_platform:6::el7 | All versions | 0:7.5.31-2.Final_redhat_2.1.ep6.el7 |
Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Mcafee Epolicy Orchestrator, Netapp Oncommand System Manager, Opensuse Leap and 12 more.
How do I fix CVE-2020-13935?
Upgrade org.apache.tomcat.embed:tomcat-embed-websocket to a fixed version for your release line: 10.0.0-M7, 7.0.105, 8.5.57 or 9.0.37.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-13935 being exploited?
There is no known exploitation of CVE-2020-13935 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2020-13935, CLSA-2026-1777446601, DEBIAN-CVE-2020-13935, GHSA-m7jv-hq7h-mq7c, RHSA-2020:3383, UBUNTU-CVE-2020-13935.