CVE-2020-1935

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-24 · updated 2026-10-08
Weakness: CWE-444

Description

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Affected products

Apache Tomcat: from 7.0.0 through 7.0.99; from 8.5.0 through 8.5.50; from 9.0.0 through 9.0.30; 9.0.0, 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13 (+22)
Canonical Ubuntu Linux: 16.04
Debian Linux: 8.0, 9.0, 10.0
NetApp Data Availability Services: all versions
OnCommand System Manager 9.x: from 3.0.0 through 3.1.3
openSUSE Leap: 15.1
Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.5, 9.3.6
Oracle Communications Element Manager: 8.1.1, 8.2.0, 8.2.1
Oracle Communications Instant Messaging Server: 10.0.1.4.0
Oracle Health Sciences Empirica Inspections: 1.0.1.2
Oracle Health Sciences Empirica Signal: 7.3.3
Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
Oracle Instantis Enterprisetrack: from 17.1 through 17.3
Oracle Corporation MySQL Enterprise Monitor: from 4.0.0 through 4.0.12; from 8.0.0 through 8.0.20
Oracle Retail Order Broker: 15.0
Oracle Corporation Siebel UI Framework: through 20.5
Oracle Corporation Transportation Management: 6.3.7
Oracle Workload Manager: 12.2.0.1, 18c, 19c

References

Get alerted when CVE-2020-1935 or the next vulnerability affects your stack