CVE-2020-17527: Apache Tomcat: Request header mix-up between HTTP/2 streams

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 24.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-03 · updated 2026-10-08
Weakness: CWE-200

Description

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

Affected products

Apache Tomcat: from 8.5.1 through 8.5.59; from 9.0.1 through 9.0.35; 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13, 9.0.0-milestone14, 9.0.0-milestone15 (+32)
Debian Linux: 9.0, 10.0
NetApp Element Plug-In: all versions
OnCommand System Manager 9.x: from 3.0.0 through 3.1.3
Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
Oracle Communications Cloud Native Core Binding Support Function: 1.10.0
Oracle Communications Cloud Native Core Policy: 1.14.0
Oracle Communications Instant Messaging Server: 10.0.1.5.0
Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
Oracle Corporation MySQL Enterprise Monitor: before 8.0.23 — fixed in 8.0.23
Oracle Corporation SD-WAN Edge: 9.0
Oracle Workload Manager: 18c, 19c

How to fix

Upgrade to a fixed version: Oracle Blockchain Platform 21.1.2; Oracle Corporation MySQL Enterprise Monitor 8.0.23. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-17527 or the next vulnerability affects your stack