CVE-2020-13934: Apache Tomcat denial of service via h2c connection leak

Executive brief

Apache Tomcat is a widely used web server and application container for Java-based websites. A vulnerability in how it handles certain web connections (h2c) can allow an attacker to crash the server by exhausting its memory. This results in a denial of service, making the hosted applications and websites unavailable to legitimate users.

Technical details

A resource leak exists in Apache Tomcat's HTTP/2 upgrade mechanism. When an h2c (HTTP/2 Cleartext) direct connection is established, the server fails to release the HTTP/1.1 processor after the protocol upgrade. An unauthenticated remote attacker can exploit this by sending a large volume of such upgrade requests, eventually triggering an OutOfMemoryException. This results in a Denial of Service (DoS) condition. The vulnerability affects versions 10.0.0-M1 to 10.0.0-M5, 9.0.0.M5 to 9.0.35, and 8.5.1 to 8.5.55. Patches are available in versions 10.0.0-M6, 9.0.36, and 8.5.56.

Affected products

• Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M5 to 9.0.35, 8.5.1 to 8.5.55
• Apache Tomcat Coyote 10.0.0-M1 to 10.0.0-M5, 9.0.0.M5 to 9.0.35, 8.5.1 to 8.5.55

Timeline

• 2020-07-14: disclosed: NVD publication date
• 2021-04-12: advisory: GitHub reviewed the advisory
• 2022-02-08: advisory: GitHub Advisory Database publication

References

• https://api.github.com/users/aruneko
• https://github.com/aruneko
• https://api.github.com/users/aruneko/gists%7B/gist_id%7D
• https://api.github.com/users/aruneko/repos
• https://avatars.githubusercontent.com/u/2957726?v=4
• https://api.github.com/users/aruneko/events%7B/privacy%7D