tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS

🗓️ 10 Aug 2020 11:21:30Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 14 Views

Tomcat WebSocket payload lengths are not validated, causing infinite loops and denial of service.

Reporter	Title	Published	Views	Family All 235
GithubExploit	Exploit for Infinite Loop in Apache Tomcat	2 Nov 202014:48	–	githubexploit
GithubExploit	pt-esign__Damn-vulnerable-sca	10 Aug 202620:56	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Cognos Business Intelligence has addressed multiple vulnerabilities (Q12021)	29 Jan 202118:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	7 Oct 202022:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - Apache Tomcat 7.099 (CVE-2020-13935)	31 Aug 202021:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Cast Iron Solution & App Connect Professional is affected by Apache Tomcat vulnerabilities.	27 Oct 202013:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2020-13935	25 Jan 202207:37	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Apache Tomcat vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (CVE-2020-13935)	30 Sep 202013:43	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Tomcat affects the IBM FlashSystem models 840 and 900	15 Apr 202117:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Apache Tomcat Vulnerabilities Affect IBM Control Center	14 May 202121:27	–	ibm

Vulners

Node

AND

redhat jboss_enterprise_application_platformRange<6.4

redhat enterprise_linux

Source	Link
mail-archives	www.mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3C39e4200c-6f4e-b85d-fe4b-a9c2bd5fdc3d%40apache.org%3E
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-7.html
tomcat	www.tomcat.apache.org/security-8.html
tomcat	www.tomcat.apache.org/security-9.html
access	www.access.redhat.com/security/cve/CVE-2020-13935
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-13935
cve	www.cve.org/CVERecord

04 Aug 2026 21:47Current

7.1High risk

Vulners AI Score7.1

CVSS 25

CVSS 3.17.5

EPSS0.86608

websocket frame payload length tomcat flaw denial of service system availability