CVE-2020-17527: Apache Tomcat: Request header mix-up between HTTP/2 streams

Modified

AliasesMGASA-2021-0020SUSE-SU-2021:0031-1SUSE-SU-2021:0041-1+8 more

Published 03-12-2020Last modified 08-10-2026

Vulnerability summary

CVE-2020-17527 is a high (CVSS 7.5) vulnerability in apache software foundation apache tomcat. EPSS estimates a 24.62% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 25% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

24.62%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 5

DSA-4835-1 OPENSUSE-SU-2024:11468-1 OPENSUSE-SU-2024:13441-1 RHSA-2021:0494 SUSE-SU-2021:0040-1 SUSE-SU-2026:1058-1+1 more

Timeline

03-12-2020
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

24.62%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 24.62% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle8 products

blockchain_platform< 21.1.2
communications_cloud_native_core_binding_support_function1.10.0
communications_cloud_native_core_policy1.14.0
communications_instant_messaging_server10.0.1.5.0
instantis_enterprisetrack17.1 | 17.2 | 17.3

Show all 8

Suse8 products

tomcat&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP1< 9.0.36-4.53.1
tomcat&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP2< 9.0.36-3.18.1
tomcat&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 9.0.36-3.58.1
tomcat&distro=SUSE Linux Enterprise Server 12 SP5< 9.0.36-3.58.1
tomcat&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 9.0.36-3.58.1

Show all 8

Debian3 products

tomcat8< 8.5.54-0+deb9u5
tomcat9< 9.0.40-1
debian_linuxEOL9.0 | 10.0

Netapp2 products

element_plug-inna
oncommand_system_manager≥ 3.0.0, ≤ 3.1.3

Opensuse2 products

tomcat&distro=openSUSE Leap 15.1< 9.0.36-lp151.3.39.1
tomcat&distro=openSUSE Leap 15.2< 9.0.36-lp152.2.16.1

Ubuntu2 products

tomcat8All versions (No fix recorded)
tomcat9< 9.0.16-3ubuntu0.18.04.2 | < 9.0.31-1ubuntu0.2

Apache1 product

tomcatEOL≥ 8.5.1, ≤ 8.5.59 | ≥ 9.0.1, ≤ 9.0.35 | 9.0.0:milestone10 | 9.0.0:milestone11 | 9.0.0:milestone12 | 9.0.0:milestone13 | 9.0.0:milestone14 | 9.0.0:milestone15 | 9.0.0:milestone16 | 9.0.0:milestone17 | 9.0.0:milestone18 | 9.0.0:milestone19 | 9.0.0:milestone20 | 9.0.0:milestone21 | 9.0.0:milestone22 | 9.0.0:milestone23 | 9.0.0:milestone24 | 9.0.0:milestone25 | 9.0.0:milestone26 | 9.0.0:milestone27 | 9.0.0:milestone5 | 9.0.0:milestone6 | 9.0.0:milestone7 | 9.0.0:milestone8 | 9.0.0:milestone9 | 9.0.35-3.39.1 | 9.0.35-3.57.3 | 9.0.36 | 9.0.37 | 9.0.38 | 9.0.39 | 10.0.0:milestone1 | 10.0.0:milestone2 | 10.0.0:milestone3 | 10.0.0:milestone4 | 10.0.0:milestone5 | 10.0.0:milestone6 | 10.0.0:milestone7 | 10.0.0:milestone8 | 10.0.0:milestone9

Apache software foundation1 product

apache tomcatApache Tomcat 10 10.0.0-M1 to 10.0.0-M9 | Apache Tomcat 9 9.0.0-M1 to 9.0.39 | Apache Tomcat 8.5 8.5.0 to 8.5.59

Mageia1 product

tomcat< 9.0.39-1.mga7

Org.apache.tomcat1 product

tomcat-coyote≥ 10.0.0-M1, < 10.0.0-M10 | ≥ 9.0.0-M1, < 9.0.40 | ≥ 8.5.0, < 8.5.60

10 vendors · 29 products

References

63 links

lists.apache.org/thread.html/…X Refsource MISCREPORTWEBMailing ListVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2020/12/03/3Mailing ListX Refsource MLISTREPORTWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST

Show all 63 references

lists.debian.org/debian-lts-announce/2020/12/msg00022.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
security.gentoo.org/glsa/202012-23Vendor AdvisoryX Refsource GENTOOWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.debian.org/security/2021/dsa-4835Vendor AdvisoryX Refsource DEBIANWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCWEBPatchThird Party Advisory
security.netapp.com/advisory/ntap-20201210-0003/X Refsource CONFIRMThird Party Advisory
www.oracle.com//security-alerts/cpujul2021.htmlX Refsource MISCWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlX Refsource MISCWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlX Refsource MISCWEBPatchThird Party Advisory
advisories.mageia.org/MGASA-2021-0020.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=27739REPORT
tomcat.apache.org/security-9.htmlWEB
www.suse.com/support/update/announcement/2021/suse-su-20210031-1/Advisory
bugzilla.suse.com/1179602REPORT
www.suse.com/security/cve/CVE-2020-17527WEB
www.suse.com/support/update/announcement/2021/suse-su-20210041-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20210042-1/Advisory
ubuntu.com/security/CVE-2020-17527REPORT
github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65REPORTWEB
github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29REPORTWEB
lists.apache.org/thread.html/…REPORTWEB
lists.apache.org/thread.html/…REPORTWEB
lists.apache.org/thread.html/…REPORTWEB
lists.apache.org/thread.html/…REPORTWEB
lists.apache.org/thread.html/…REPORTWEB
ubuntu.com/security/notices/USN-5360-1Advisory
www.cve.org/CVERecord?id=CVE-2020-17527REPORT
security-tracker.debian.org/tracker/CVE-2020-17527Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
nvd.nist.gov/vuln/detail/CVE-2020-17527AdvisoryOval
github.com/apache/tomcat/commit/8d2fe6894d6e258a6d615d7f786acca80e6020cbWEB
security.netapp.com/advisory/ntap-20201210-0003WEB
tomcat.apache.org/security-10.htmlWEB
tomcat.apache.org/security-8.htmlWEB
tomcat.apache.org/security-9.htmlWEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
github.com/apache/tomcatPACKAGE
bz.apache.org/bugzilla/show_bug.cgi?id=64830WEB