CVE-2020-11996

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2020
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-119974.3Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users sha CVE-2020-119989.8A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of CVE-2020-119998.1FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-12008.6<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application CVE-2020-120007.5The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied CVE-2020-120019.8FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-120029.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lac CVE-2020-120037.5FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-120047.5The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignit CVE-2020-120057.5FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-120069.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a lo CVE-2020-120079.8A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition du