NetSight
IP …
high7.5

CVE-2020-11996

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usa…

Impact

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Affected products

VendorProductAffected versions
ApacheTomcat
from 8.5.0 through 8.5.55
from 9.0.0 through 9.0.35
Versions 9.0.0, 10.0.0
CanonicalUbuntu Linux
Version 20.04
OracleMysql Enterprise Monitor
through 8.0.21
OracleSiebel Ui Framework
through 20.12
OracleWorkload Manager
Versions 12.2.0.1, 18c, 19c
OpensuseLeap
Versions 15.1, 15.2
DebianDebian Linux
Versions 9.0, 10.0
NetappOncommand System Manager
Versions 3.0, 3.1.3

References