ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2020-13935

—
CVSS 3.1
7.5 high
EPSS
87%p100
Published
()
Modified
Description

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Vendors
apachedebiannetappopensusecanonicalmcafeeoracle
Products
tomcat, debian linux, oncommand system manager, leap, ubuntu linux, epolicy orchestrator, agile engineering data management, agile product lifecycle management, blockchain platform, commerce guided search, communications cloud native core policy, communications instant messaging server
Weakness
CWE-835
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (86.6%)

In the news

No ingested article mentions this CVE yet.