CVE-2020-17527
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
- Affected products
- Alt Linux, Apache Tomcat, Linuxmint, Suse, Ubuntu
- Apache Tomcat
- ≤ 8.5.59, 9.0.35, 9.0.0, 9.0.35-3.39.1, 9.0.35-3.57.3, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 10.0.0
- Fix
- Available
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 24.6% (98th percentile)
- Weakness
- CWE-200
- NVD status
- Modified
- Published
- 2020-12-03
CVE-2020-17527 at NVD
No indexed exploits for CVE-2020-17527 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2020-17527 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.