CVE-2020-13943

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type: GIT
Repo: https://github.com/apache/tomcat
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

00b711f6af57e043bf4d5d64dbc1617970a54d69

Last affected

054f4eb88b6fe969af20ee78687cd40a271f8116

Last affected

05bfeed882fadd6e3b5c64a7851125750d37e297

Last affected

0862607e5da91a7c476a6350288d8d8a9380f556

Last affected

0b365bb7032a5e30b35fedc56e7def82a3e55f94

Last affected

0f7cba76901cc129cd0f04956b84f703349548b5

Last affected

100ca6fcaf5aceb8fecd5cff0c45e1d52f8baaed

Last affected

1031a8edb864ac001a8f172161aa8a13b7a4e712

Last affected

10e04de1946981261a734507f4a6d953e2a206fe

Last affected

1490a3f542c89c9c74127a134cea4000d857189e

Last affected

14bdacea996993a3b94ec0972cea92370e42ae4d

Last affected

16bf392c67833ad549733b58c350ff92b5ee782a

Last affected

18fac60288f15ded6a738066d230cdb6423a5b25

Last affected

20ec6f6f034bb5eebe4f1b52140b680aaff6f380

Last affected

24566c02fb917a6ca1b6479a60971b0d8acd895c

Last affected

247c8e5ad08cdcd829a0bfc6374ecb3da0e5838e

Last affected

25d7c99e8c44a41a08ba85ccaba3cfec6af9c801

Last affected

27f7ef8cd0c637b700d564ec20f6ff92901f6b5c

Last affected

2bd753075d4f87ee9db49d3ad55cfaec78a82329

Last affected

34735123777fe15a5525b8242964293cddbfae64

Last affected

35071e7e52f296b9187b054b0efd74121b7db3bd

Last affected

35174cb9cfa4cf3d608db77485043af42cf92c8c

Last affected

389365303d986b2a918bc95f39421b27a2c9ff30

Last affected

3a9578990e4e90bcc04bf7d5ef3bc47445e827e6

Last affected

3bd48aab236e5bf0ed1644e9f0c588fd20e503ab

Last affected

3c78e95e36268dfb76db1570f0cf49104fa6eabc

Last affected

3e5565173dfe107f90419ab63bd4e2e7edc9deb4

Last affected

4178d385e09435a88ac34cf7025526b7f0055c55

Last affected

4202de2f20c29f38a6a700133f9724745c7306d8

Last affected

4560d2f5a49965f73ed07cb879f17d9c096c9d13

Last affected

45f8fd74cdb96490fab8709263a4d862f0d429cf

Last affected

46d444a14cdac3e7e1f011a02cbdac9e5a80631c

Last affected

4b0b2f6b828d12d150b4de0b64fd6c3849dfcefb

Last affected

4e32ede8c5c5ed6937d29a37b5108dfcd13c5954

Last affected

4fab4cc012d0c31852e957d198cb0549f3d6074c

Last affected

508a36c1f48c8d500c4e205097c2ade93e589d13

Last affected

54502a9e8796f87ff77b1e32251e2836f6671149

Last affected

593f3797c2de532988387692bb5f9a283c6182c5

Last affected

59e713216cf2256aacc54f6ba627865f356f9e4e

Last affected

5dd82367de857318b8a384c07c4414e5d55cc975

Last affected

5ec070352b283535946327b44228b610a27a76c5

Last affected

5eda69269ed3267d9757c0e2efbb86ef8fa8bca9

Last affected

600dc8ba5d9be7599d29bff83c342213d93b034e

Last affected

6158eb84d9a15565787eda7e37f3e2f220a34a54

Last affected

61ff12fb282b1d00593b8d16e94ab8ec02f8d5be

Last affected

642d3dd4d50ea1f03f9827962e4fc982a123bb78

Last affected

65ddc3a3872ea41ca67fec7b6834c704b6893361

Last affected

66ebf0df1f2f072d1ecdf63f391026fb1b49bae2

Last affected

6a8acc17f2dea12cf6366b5a1fa4fe62a1c36137

Last affected

6c514146fe3ba81aefcc3ef74a158d8bafee2fcf

Last affected

706a395be7c34414d04739de69bde986661976ec

Last affected

753f95658fb9a26594d8f9cc65a48de04d2e7bd7

Last affected

772df65db45cfccc2aad33b9b51ef9ab14c19626

Last affected

7c14efedba0cc81319efacb0e7f5129804e7b6f9

Last affected

7d6cf6ec6c467a5cd3fd69c50d5fde5b4d7b4f5f

Last affected

7dc5e29fe49850102261badf158752d6865311e4

Last affected

80083369bb8178efc49374a65d7eb73465e77f8b

Last affected

854f4dcf435a6d335576aa22402e2871c66f4fd9

Last affected

8641cef9edb88303736a0e19d31cf7f7bd4ca5bb

Last affected

89b28f6ba651c13de6d63f615b23a33b2877f7ac

Last affected

8c48678b110f3fbbe66f6dde0e45d2578fa92c29

Last affected

8d7a4e2f583e322f2c5ca939c00df1c5d61dad7d

Last affected

90583be4f77c92d8e8ac4a48e63b3cdc31e45890

Last affected

914f68b45127207170dff894e03ec31732cac898

Last affected

917125ae55a807a90a96d97ecbec5ed13620bc18

Last affected

91f0a6076a682a62c8f1036701ce16ed587385ce

Last affected

95f7f98eef1d3521ee25617c07a36d22daba84ea

Last affected

988f68f551e8dbd53d1bc45b8a0cda14ff09dc54

Last affected

9babbd0b0560303fbe5cc5bf7e7c2a8e74e4d665

Last affected

9c5edb840d9413c1408e7c191bc0e1bbfcd9e07f

Last affected

9c649984ef92c2534a734c6584220a9a0c0c3462

Last affected

9dc486b616a1599fa3fa4e27a7933ca06bfa4785

Last affected

a61b9e5bde9b0ad7681bed4730b4ecafc05ff97b

Last affected

aac670afe1226e10513021100fce8a12344743c6

Last affected

ab04166fac59fcf9b3be3aab1c8b896842782d4c

Last affected

aba238718ac9b149d25feaa9a14ecad3b0e3a5e2

Last affected

b0370640a65d7cb28485f842c959cf4b489eccc1

Last affected

b0b074b683ed2e09ff9e9755825bfce83d303a93

Last affected

b13bcf27d84debed0519f36449b7a5443c3bd0e6

Last affected

b3a208c6d6d01c553178c5e718e750b0eb318151

Last affected

b3d863f29edd6dbee7e78974c2ca110d0b4dd4ae

Last affected

b5205c92f41dfd9a67f78bc783db7b022e38226c

Last affected

b5a74e3c7913c560648f0ffedfbbb3ebe4318def

Last affected

b6ff6f5c8a977fad074ae64c7ba4e38968d70b86

Last affected

bd48c597e3cb280d73d9c9279babcaf75b6879c0

Last affected

bd68c421ea32fea08263db73cd5b987ab606a0bb

Last affected

bdd72e8bc872876689e41631e47942366ca03364

Last affected

c25bae42cd21ba0a376ce3cce14800a34a0ede00

Last affected

c2c8107f0cea4755497a85990807b883b66f6b57

Last affected

c40ede65ea4fb44b1957ec482f28c7afa71f1b50

Last affected

c4e46147542892179c6be8b815f2f19637d7b4bf

Last affected

c549413165721180b15f62033c1be6c5970028fd

Last affected

c5efed313de1a181f4f9f98f5023117f3b911257

Last affected

c6a2c4ed296c7f8839b72e8e31cb53b84102d02c

Last affected

c7b84102600d600bcc527560d9c4d10c3fd440ab

Last affected

c83fd06b3cd0c96ffd7dc660107a1283b714483b

Last affected

c8a57e4a2db8e5af314bae48123fb5990da5b7a5

Last affected

cac0e029dcced854eeca7444710e78e412dc2c2a

Last affected

cc079ea2c2beeaae22131ffc2c2c9f4dff20ddab

Last affected

d4e9735adc0819314811c134d7899adcdb0f629e

Last affected

d628ee1e6e1121d60b4990239c242d0e18a25e42

Last affected

d8ebf61e51b4455e3c226751e492a533f9002d48

Last affected

d971ce1bdf8b8e8de93fb41454f4ce2e815ee936

Last affected

de128d72af746184e035ff1b53629f08cb141a04

Last affected

e0c759f3bd47e06b9d526ed40ed9d1e923f464b6

Last affected

e0fdefed3d9e2a4dbfd36a5a79e75e0eadaa201d

Last affected

e14e9824c3087f79621a9796ddf9b3432be02858

Last affected

e37b977db6f47e4380ad67114a49e8568951c953

Last affected

e5f53cc522d4e1e97f1a8805d4d6c74d4e187b77

Last affected

e8b640021afce5430678b590813d18b92e06a430

Last affected

e95b65a27af4cd6681b6dc1bf17ee5abb897610d

Last affected

eb684224706fe1d8ef5610c8d79dc403e1038393

Last affected

f212f9d743b463763dab22f5ec7e3077f33bd326

Last affected

f2fb9fd39b97f3e1f84c6745359d821210446b09

Last affected

f47ce1999ed77630cbcc65fe98af135d4072b6a3

Last affected

f481565d959dc5a5eae1576cc294774c8683b4dc

Last affected

f496ba0669fcdc034683aab80e627de5aee50b8e

Last affected

f5dffa6e1148080fe5dc3690df917e805c72a714

Last affected

f827002704439e842b2450c3ce9da2f421b4f7d6

Last affected

fa23d9518b2a8d6b0ab0dcdb0a4e3e2866e8bad7

Last affected

fad275b0541595ea89e59f5cb024ada531d5dbe4

Last affected

fbeeca5fb941c59a901ba7324dca4f15f3b666bb

Last affected

fc2c65d390444d75412855ad0de8b878018d02dc

Last affected

fd2639aedf7d8cfb464094000a12f850ae1f2709

Last affected

fdeed5fdfb166f13d74a9feb7ee1ac294aaac54c

Last affected

fe854ab1f111396458d98fa2ab08c693ce9407e1