Vulnerability record · CVE-2020-13943 · published 12 October 2020
CVE-2020-13943: Apache Tomcat HTTP/2 header mix-up leaks cross-request data
Apache · Tomcat
Apache Tomcat fails to isolate HTTP/2 request headers when a client exceeds the agreed maximum concurrent streams on a connection. A later request on that connection can carry headers, including HTTP/2 pseudo headers, from a previous request, so users may receive responses for resources they did not request.
Description
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Automated analysis
medium priorityThe flaw is remotely reachable and has a high EPSS score, but it only yields limited confidentiality impact and no known exploitation.
What it is
Apache Tomcat fails to isolate HTTP/2 request headers when a client exceeds the agreed maximum concurrent streams on a connection. A later request on that connection can carry headers, including HTTP/2 pseudo headers, from a previous request, so users may receive responses for resources they did not request.
Impact
An attacker can cause a victim to receive responses intended for another request, exposing limited information about other resources on the same connection. The CVSS vector rates confidentiality impact as low with no integrity or availability effect.
Attack surface
Reachable over the network by any HTTP/2 client that can open a connection and exceed the negotiated concurrent stream limit. The vector requires low privileges (PR:L) and no user interaction, and the flaw is in the server's HTTP/2 stream handling.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at roughly 0.57 (99th percentile), but the references are advisories and patches only, with no public exploit or in-the-wild activity cited.
What to do
- Upgrade Tomcat to a release after 10.0.0-M7, 9.0.37 or 8.5.57, or apply the vendor fix referenced in the Apache advisory.
- Apply the Oracle CPU April 2021 and Debian DSA-4835 updates for bundled or packaged Tomcat instances.
- If immediate patching is not possible, disable HTTP/2 or restrict HTTP/2 clients to trusted networks.
- Audit reverse proxies and load balancers that terminate HTTP/2 to confirm they enforce stream limits and do not forward mixed headers.
Detection
- Monitor Tomcat and reverse-proxy logs for HTTP/2 clients repeatedly exceeding the maximum concurrent stream limit.
- Look for anomalous response-to-request mismatches, such as users receiving content for URLs they did not request.
- Track HTTP/2 connection resets or protocol errors that cluster around a single client or source address.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-13943 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-13943), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
