CVE-2020-17527 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 10.0.0-M10, 9.0.40, 8.5.60 |
| Weakness | Information exposure (CWE-200) |
| Published | 3 Dec 2020 |
| Updated | 8 Oct 2026 |
Description
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 25% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | forse01/CVE-2020-17527-Tomcat | 2 | 2021-02-05 |
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
A public code fix exists: apache/tomcat 21e3408.
- Protection none
- Action unverified
- Review automated Upstream data
- Record active
| Decided by | Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all |
|---|---|
| Finding | This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious. |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Blockchain Platform / BCS Console (Apache Tomcat) (Prior to 21.1.2) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications / Binding Support Function (Apache Tomcat) (1.10.0) Oracle Communications / Policy (Apache Tomcat) (1.14.0) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Big Data Graph / Big Data Graph (Apache Tomcat) (Prior to 23.1) Oracle Communications Applications / Transformation for PDC (Apache Tomcat) (12.0.0.3.0) Oracle Retail Applications / Xenvironment (Apache Tomcat) (16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Communications / MGMT (Apache Tomcat) (9.0) Oracle Construction and Engineering / WebServer (Apache Tomcat) (17.1, 17.2, 17.3) Oracle Database Server / Workload Manager (Apache Tomcat) (18c, 19c) Oracle MySQL / Monitoring: General (Apache Tomcat) (8.0.23 and prior) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Big Data Graph | Big Data Graph (Apache Tomcat) | Prior to 23.1 | |
| Oracle Blockchain Platform | BCS Console (Apache Tomcat) | Prior to 21.1.2 | |
| Oracle Communications | Binding Support Function (Apache Tomcat) | 1.10.0 | 1.10.0 |
| Oracle Communications | MGMT (Apache Tomcat) | 9.0 | 9.0 |
| Oracle Communications | Policy (Apache Tomcat) | 1.14.0 | 1.14.0 |
| Oracle Communications Applications | Transformation for PDC (Apache Tomcat) | 12.0.0.3.0 | 12.0.0.3.0 |
| Oracle Construction and Engineering | WebServer (Apache Tomcat) | 17.1, 17.2, 17.3 | 17.1 · 17.2 · 17.3 |
| Oracle Database Server | Workload Manager (Apache Tomcat) | 18c, 19c | 18 · 19 |
| Oracle MySQL | Monitoring: General (Apache Tomcat) | 8.0.23 and prior | |
| Oracle Retail Applications | Xenvironment (Apache Tomcat) | 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1 | 16.0.6 · 17.0.4 · 18.0.3 · 19.0.2 · 20.0.1 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat:tomcat-coyote |
10.0.0-M1 | 10.0.0-M10 |
unbounded |
org.apache.tomcat:tomcat-coyote |
9.0.0-M1 | 9.0.40 |
unbounded |
org.apache.tomcat:tomcat-coyote |
8.5.0 | 8.5.60 |
unbounded |
Products and versions
13 products, 58 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | ≥ 8.5.1 and ≤ 8.5.59 · 9.0.0:milestone10 · 9.0.0:milestone11 · 9.0.0:milestone12 · 9.0.0:milestone13 · 9.0.0:milestone14 · 9.0.0:milestone15 · 9.0.0:milestone16 · 9.0.0:milestone17 · 9.0.0:milestone18 · 9.0.0:milestone19 · 9.0.0:milestone20 · 9.0.0:milestone21 · 9.0.0:milestone22 · 9.0.0:milestone23 · 9.0.0:milestone24 · 9.0.0:milestone25 · 9.0.0:milestone26 · 9.0.0:milestone27 · 9.0.0:milestone5 · 9.0.0:milestone6 · 9.0.0:milestone7 · 9.0.0:milestone8 · 9.0.0:milestone9 · ≥ 9.0.1 and ≤ 9.0.35 · 9.0.35-3.39.1 · 9.0.35-3.57.3 · 9.0.36 · 9.0.37 · 9.0.38 · 9.0.39 · 10.0.0:milestone1 · 10.0.0:milestone2 · 10.0.0:milestone3 · 10.0.0:milestone4 · 10.0.0:milestone5 · 10.0.0:milestone6 · 10.0.0:milestone7 · 10.0.0:milestone8 · 10.0.0:milestone9 |
| nvd | debian | debian linux | generic | 9.0 · 10.0 |
| nvd | netapp | element plug-in | generic | any version |
| nvd | netapp | oncommand system manager | generic | ≥ 3.0.0 and ≤ 3.1.3 |
| nvd | oracle | blockchain platform | generic | ＜ 21.1.2 |
| nvd | oracle | communications cloud native core binding support function | generic | 1.10.0 |
| nvd | oracle | communications cloud native core policy | generic | 1.14.0 |
| nvd | oracle | communications instant messaging server | generic | 10.0.1.5.0 |
| nvd | oracle | instantis enterprisetrack | generic | 17.1 · 17.2 · 17.3 |
| nvd | oracle | mysql enterprise monitor | generic | ＜ 8.0.23 |
| nvd | oracle | sd-wan edge | generic | 9.0 |
| nvd | oracle | workload manager | generic | 18c · 19c |
| osv | org.apache.tomcat | tomcat-coyote | generic | ≥ 8.5.0 and ＜ 8.5.60 · ≥ 9.0.0 and ＜ 9.0.40 · ≥ 10.0.0 and ＜ 10.0.0 |
References
Timeline
Timeline
| Published | 2020-12-03 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |