CVE-2020-11996: Apache Tomcat denial of service via HTTP/2 resource consumption

CVE-2020-11996 · Severity: high · CVSS 7.5 · Published 2022-02-09

Apache Tomcat is a widely used web server and application container for Java-based websites. A vulnerability in its handling of HTTP/2 traffic allows an attacker to send a specific sequence of requests that causes the server's processor usage to spike. If enough of these requests are sent at once, the server can become completely unresponsive, leading to a denial of service for legitimate users.

Technologies: org.apache.tomcat:tomcat (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2020-11996 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-11996 being exploited in the wild.
How severe is CVE-2020-11996?
High severity, with a CVSS score of 7.5, published 9 February 2022.
Which products and versions are affected?
org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=10.0.0-M1,fixed=10.0.0-M5; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=10.0.0-M1,fixed=10.0.0-M5.
Is there a fix for CVE-2020-11996?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 10.0.0-M5 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.0.0-M5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-11996 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-11996?
Check whether you run org.apache.tomcat:tomcat (Maven) or org.apache.tomcat.embed:tomcat-embed-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 10.0.0-M5 or later
    # set org.apache.tomcat:tomcat to 10.0.0-M5 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.0.0-M5 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 10.0.0-M5 in your pom.xml or build.gradle

Technical details

An uncontrolled resource consumption vulnerability (CWE-400) exists in Apache Tomcat's HTTP/2 implementation. By sending a specifically crafted sequence of HTTP/2 requests, a remote, unauthenticated attacker can trigger high CPU usage for several seconds per request. When multiple such requests are sent concurrently over multiple connections, the cumulative CPU load can exhaust server resources, resulting in a denial-of-service (DoS) condition. The issue is resolved in Apache Tomcat versions 10.0.0-M5, 9.0.35, and 8.5.55.

Affected products

  • Apache Tomcat 8.5.0 to 8.5.54, 9.0.0.M1 to 9.0.34, 10.0.0-M1 to 10.0.0-M4
  • Apache tomcat-embed-core 8.5.0 to 8.5.54, 9.0.0.M1 to 9.0.34, 10.0.0-M1 to 10.0.0-M4

Identifiers

  • CVE-2020-11996
  • GHSA-53hp-jpwq-2jgq

Timeline

  • 2020-06-26: disclosed
  • 2022-02-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.