CVE-2020-13935

HighCVSS 7.5

Published: 14/07/2020(UTC)Updated: 25/08/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

86.61%

100th percentile - higher than 100% of all known CVEs

Summary

In Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104, the payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop, and multiple requests with invalid payload lengths could lead to a denial of service.

Risk Assessment

An attacker can cause service unavailability (DoS) by sending specially crafted WebSocket requests.

Recommendation

Upgrade Apache Tomcat to a version that includes the fix (e.g., 9.0.37, 8.5.57, 7.0.105 or later).

Original NVD description (English source)

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.