CVE-2020-13935: Apache Tomcat WebSocket frame payload length validation flaw enables DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote denial of service with a very high EPSS score, though no KEV listing or documented in-the-wild exploitation.

What it is

Apache Tomcat fails to correctly validate the payload length in WebSocket frames, allowing invalid lengths to trigger an infinite loop. Repeated requests with malformed payload lengths can exhaust server resources and cause a denial of service. The flaw affects Tomcat 10.0.0-M1 through 10.0.0-M6, 9.0.0.M1 through 9.0.36, 8.5.0 through 8.5.56, and 7.0.27 through 7.0.104.

Impact

An unauthenticated remote attacker can drive the Tomcat process into an infinite loop, degrading or halting WebSocket service availability for legitimate users. No confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via the WebSocket protocol on a Tomcat listener; the CVSS vector shows no privileges required and no user interaction. Any exposed WebSocket endpoint on an affected Tomcat version is a candidate path.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.866 probability, 99.7th percentile), indicating strong likelihood of attempted exploitation. References are vendor advisories and patch notices, with no public exploit tag supplied.

What to do

• Upgrade Tomcat to a fixed release: 10.0.0-M7 or later, 9.0.37 or later, 8.5.57 or later, or 7.0.105 or later.
• Apply vendor patches for downstream products that bundle Tomcat (Oracle, Debian, Ubuntu, openSUSE, NetApp, McAfee) per their advisories.
• If immediate upgrade is not possible, restrict or disable WebSocket endpoints and limit network exposure of Tomcat connectors.
• Rate-limit and monitor inbound WebSocket traffic at the reverse proxy or load balancer to blunt repeated malformed-frame floods.

Detection

• Monitor Tomcat/Java process CPU saturation and thread dumps showing threads stuck in WebSocket frame parsing loops.
• Alert on high volumes of WebSocket upgrade requests or malformed frame lengths from single sources in proxy or WAF logs.
• Track availability gaps or timeouts on WebSocket endpoints and correlate with source IPs sending repeated anomalous frames.
• Audit deployed Tomcat versions against the affected ranges to find unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.