CVE-2020-13935

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

VendorProductVersions
n/aApache TomcatApache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, 7.0.27 to 7.0.104

References

Timeline

Published
Jul 14, 2020
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-139368.8An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileCVE-2020-139375.3Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3CVE-2020-139385.5Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on WindowsCVE-2020-13947.8An elevation of privilege vulnerability exists in the way that the Windows Geolocation Framework handles objects in memory, aka 'Windows EleCVE-2020-139405.5In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trustCVE-2020-139418.8Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.aCVE-2020-139429.8It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new CVE-2020-139434.3If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum nuCVE-2020-139446.1In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.CVE-2020-139456.5In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allCVE-2020-139465.9In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access CVE-2020-139476.1An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp
CVE-2020-13935: High severity, CVSS 7.5 | Vulnix