CVE-2020-13934: Apache Tomcat h2c upgrade memory leak denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with a network, unauthenticated, low-complexity vector and very high EPSS make remote denial of service a realistic risk despite no KEV listing.

What it is

Apache Tomcat fails to release the HTTP/1.1 processor after an h2c direct connection upgrades to HTTP/2, leaking memory on each such request. Enough of these requests exhaust the heap with an OutOfMemoryException, taking the server down. The flaw affects Tomcat 10.0.0-M1 through 10.0.0-M6, 9.0.0.M5 through 9.0.36, and 8.5.1 through 8.5.56.

Impact

An unauthenticated remote attacker can exhaust server memory and cause a denial of service, making hosted applications unavailable. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reached over the network via h2c direct connections that trigger an HTTP/1.1 to HTTP/2 upgrade, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is high at roughly 0.64 (99th percentile), indicating elevated likelihood of attempted exploitation. References are vendor advisories, release notes and third-party patch notices, with no public exploit tagged.

What to do

• Upgrade Tomcat to a fixed release beyond 10.0.0-M6, 9.0.36 or 8.5.56, or apply the vendor patch.
• Apply distribution and downstream vendor updates (Debian, Ubuntu, openSUSE, NetApp, Oracle) for bundled Tomcat.
• If h2c is not needed, disable cleartext HTTP/2 upgrade support or restrict it at the reverse proxy.
• Cap JVM heap and monitor for OutOfMemoryException to limit blast radius.
• Rate-limit or block untrusted clients that repeatedly issue h2c upgrade requests.

Detection

• Monitor Tomcat and JVM logs for OutOfMemoryException and heap exhaustion events.
• Alert on spikes in h2c upgrade requests, especially from single sources.
• Track JVM heap usage trends for abnormal growth correlated with HTTP/2 upgrade traffic.
• Review access logs for repeated Upgrade: h2c headers from the same client.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.