Infinite Loop in Apache Tomcat (CVE-2020-13935)

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven), org.apache.tomcat.embed:tomcat-embed-websocket (maven) and additional mapped packages. Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:a:apache:tomcat::::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:10.0.0:milestone1::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:10.0.0:milestone3::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:10.0.0:milestone4::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:10.0.0:milestone5::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:10.0.0:milestone6::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone1::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone2::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone3::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone4::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::	Not reported	Not reported
cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8::::::	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:::::::*	Not reported	Not reported
cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:::::::*	Not reported	Not reported
cpe:2.3:a:netapp:oncommand_system_manager::::::::	Not reported	Not reported
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:blockchain_platform::::::::	Not reported	Not reported
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:mysql_enterprise_monitor::::::::	Not reported	Not reported
cpe:2.3:a:oracle:siebel_ui_framework::::::::	Not reported	Not reported
cpe:2.3:a:oracle:workload_manager:12.2.0.1:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:workload_manager:18c:::::::*	Not reported	Not reported
cpe:2.3:a:oracle:workload_manager:19c:::::::*	Not reported	Not reported
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::	Not reported	Not reported
cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::	Not reported	Not reported
cpe:2.3:o:debian:debian_linux:10.0:::::::*	Not reported	Not reported
cpe:2.3:o:debian:debian_linux:9.0:::::::*	Not reported	Not reported
cpe:2.3:o:opensuse:leap:15.1:::::::*	Not reported	Not reported
cpe:2.3:o:opensuse:leap:15.2:::::::*	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
org.apache.tomcat.embed:tomcat-embed-websocketmaven	>=7.0.27,<7.0.105	7.0.105
org.apache.tomcat.embed:tomcat-embed-websocketmaven	>=8.5.0,<8.5.57	8.5.57
org.apache.tomcat.embed:tomcat-embed-websocketmaven	>=9.0.0.M1,<9.0.37	9.0.37
org.apache.tomcat.embed:tomcat-embed-websocketmaven	>=10.0.0-M1,<10.0.0-M7	10.0.0-M7
org.apache.tomcat.embed:tomcat-embed-websocketmaven	>=7.0.27 <7.0.105	7.0.105
org.apache.tomcat.embed:tomcat-embed-websocketmaven	>=8.5.0 <8.5.57	8.5.57
org.apache.tomcat.embed:tomcat-embed-websocketmaven	>=9.0.0.M1 <9.0.37	9.0.37
org.apache.tomcat.embed:tomcat-embed-websocketmaven	>=10.0.0-M1 <10.0.0-M7	10.0.0-M7
org.apache.tomcat:tomcatmaven	>=10.0.0-M1,<10.0.0-M7	10.0.0-M7
org.apache.tomcat:tomcatmaven	>=9.0.0.M1,<9.0.37	9.0.37
org.apache.tomcat:tomcatmaven	>=8.5.0,<8.5.57	8.5.57
org.apache.tomcat:tomcatmaven	>=7.0.27,<7.0.105	7.0.105
org.apache.tomcat:tomcatmaven	>=10.0.0-M1 <10.0.0-M7	10.0.0-M7
org.apache.tomcat:tomcatmaven	>=9.0.0.M1 <9.0.37	9.0.37
org.apache.tomcat:tomcatmaven	>=8.5.0 <8.5.57	8.5.57
org.apache.tomcat:tomcatmaven	>=7.0.27 <7.0.105	7.0.105
org.apache.tomcat:tomcat-websocketmaven	>=10.0.0-M1,<10.0.0-M7	10.0.0-M7
org.apache.tomcat:tomcat-websocketmaven	>=9.0.0.M1,<9.0.37	9.0.37
org.apache.tomcat:tomcat-websocketmaven	>=8.5.0,<8.5.57	8.5.57
org.apache.tomcat:tomcat-websocketmaven	>=7.0.27,<7.0.105	7.0.105
org.apache.tomcat:tomcat-websocketmaven	>=10.0.0-M1 <10.0.0-M7	10.0.0-M7
org.apache.tomcat:tomcat-websocketmaven	>=9.0.0.M1 <9.0.37	9.0.37
org.apache.tomcat:tomcat-websocketmaven	>=8.5.0 <8.5.57	8.5.57
org.apache.tomcat:tomcat-websocketmaven	>=7.0.27 <7.0.105	7.0.105

Recommended response

Check inventory. Check lockfiles and deployed manifests for org.apache.tomcat.embed:tomcat-embed-websocket, org.apache.tomcat.embed:tomcat-embed-websocket, org.apache.tomcat.embed:tomcat-embed-websocket.
Review the reported fix. Update org.apache.tomcat.embed:tomcat-embed-websocket to 7.0.105; org.apache.tomcat.embed:tomcat-embed-websocket to 8.5.57; org.apache.tomcat.embed:tomcat-embed-websocket to 9.0.37; org.apache.tomcat.embed:tomcat-embed-websocket to 10.0.0-M7; org.apache.tomcat.embed:tomcat-embed-websocket to 7.0.105; org.apache.tomcat.embed:tomcat-embed-websocket to 8.5.57; org.apache.tomcat.embed:tomcat-embed-websocket to 9.0.37; org.apache.tomcat.embed:tomcat-embed-websocket to 10.0.0-M7; org.apache.tomcat:tomcat to 10.0.0-M7; org.apache.tomcat:tomcat to 9.0.37; org.apache.tomcat:tomcat to 8.5.57; org.apache.tomcat:tomcat to 7.0.105; org.apache.tomcat:tomcat to 10.0.0-M7; org.apache.tomcat:tomcat to 9.0.37; org.apache.tomcat:tomcat to 8.5.57; org.apache.tomcat:tomcat to 7.0.105; org.apache.tomcat:tomcat-websocket to 10.0.0-M7; org.apache.tomcat:tomcat-websocket to 9.0.37; org.apache.tomcat:tomcat-websocket to 8.5.57; org.apache.tomcat:tomcat-websocket to 7.0.105; org.apache.tomcat:tomcat-websocket to 10.0.0-M7; org.apache.tomcat:tomcat-websocket to 9.0.37; org.apache.tomcat:tomcat-websocket to 8.5.57; org.apache.tomcat:tomcat-websocket to 7.0.105 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 14, 2020
Evidence: source:ghsa:source_dates:source-dates:record
Source modified
Aug 25, 2026
Evidence: source:ghsa:source_dates:source-dates:record
First seen by HOL
Jun 11, 2026

Sources and claim methodology

Upstream source description

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Quoted source text, attributed separately from HOL analysis.