UBUNTU-CVE-2020-1935
Advisory lineage Upstream: 1 Downstream: 1
Upstream
Downstream
Published: 24 Feb 2020, 22:15
Last modified:04 Jun 2026, 12:45
Vulnerability Summary
Overall Risk (default)
low
19/100 CVSS Score
4.8 MEDIUM
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
24 Feb 2020, 22:15
Published
Vulnerability first disclosed
04 Jun 2026, 12:45
Last Modified
Vulnerability information updated
Description
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVSS Metrics
- v3.1•MEDIUM•Score: 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Systems
- ubuntu•tomcat7
all
- ubuntu•tomcat8
< 8.0.32-1ubuntu1.13 | all
- ubuntu•tomcat9
all