Vulnerabilities > CVE-2020-13934 - Memory Leak vulnerability in multiple products

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Tomcat 9.0.0 Apache Tomcat 10.0.0 Apache Tomcat 9.0.1 Apache Tomcat 9.0.2 Apache Tomcat 9.0.3 Apache Tomcat 9.0.4 Apache Tomcat 9.0.5 Apache Tomcat 9.0.6 Apache Tomcat 9.0.7 Apache Tomcat 9.0.8 Apache Tomcat 9.0.9 Apache Tomcat 9.0.10 Apache Tomcat 9.0.11 Apache Tomcat 9.0.12 Apache Tomcat 9.0.13 Apache Tomcat 9.0.14 Apache Tomcat 9.0.15 Apache Tomcat 9.0.16 Apache Tomcat 9.0.17 Apache Tomcat 9.0.18 Apache Tomcat 9.0.19 Apache Tomcat 9.0.20 Apache Tomcat 9.0.21 Apache Tomcat 9.0.22 Apache Tomcat 9.0.23 Apache Tomcat 9.0.24 Apache Tomcat 9.0.25 Apache Tomcat 9.0.26 Apache Tomcat 9.0.27 Apache Tomcat 9.0.28 Apache Tomcat 9.0.29 Apache Tomcat 9.0.30 Apache Tomcat 9.0.31 Apache Tomcat 9.0.32 Apache Tomcat 9.0.33 Apache Tomcat 9.0.34 Apache Tomcat 9.0.35 Apache Tomcat 9.0.35-3.39.1 Apache Tomcat 9.0.35-3.57.3 Apache Tomcat 9.0.36 Apache Tomcat 8.5.1 Apache Tomcat 8.5.2 Apache Tomcat 8.5.3 Apache Tomcat 8.5.4 Apache Tomcat 8.5.5 Apache Tomcat 8.5.6 Apache Tomcat 8.5.7 Apache Tomcat 8.5.8 Apache Tomcat 8.5.9 Apache Tomcat 8.5.10 Apache Tomcat 8.5.11 Apache Tomcat 8.5.12 Apache Tomcat 8.5.13 Apache Tomcat 8.5.14 Apache Tomcat 8.5.15 Apache Tomcat 8.5.16 Apache Tomcat 8.5.17 Apache Tomcat 8.5.18 Apache Tomcat 8.5.19 Apache Tomcat 8.5.20 Apache Tomcat 8.5.21 Apache Tomcat 8.5.22 Apache Tomcat 8.5.23 Apache Tomcat 8.5.24 Apache Tomcat 8.5.25 Apache Tomcat 8.5.26 Apache Tomcat 8.5.27 Apache Tomcat 8.5.28 Apache Tomcat 8.5.29 Apache Tomcat 8.5.30 Apache Tomcat 8.5.31 Apache Tomcat 8.5.32 Apache Tomcat 8.5.33 Apache Tomcat 8.5.34 Apache Tomcat 8.5.35 Apache Tomcat 8.5.36 Apache Tomcat 8.5.37 Apache Tomcat 8.5.38 Apache Tomcat 8.5.39 Apache Tomcat 8.5.40 Apache Tomcat 8.5.41 Apache Tomcat 8.5.42 Apache Tomcat 8.5.43 Apache Tomcat 8.5.44 Apache Tomcat 8.5.45 Apache Tomcat 8.5.46 Apache Tomcat 8.5.47 Apache Tomcat 8.5.48 Apache Tomcat 8.5.49 Apache Tomcat 8.5.50 Apache Tomcat 8.5.51 Apache Tomcat 8.5.52 Apache Tomcat 8.5.53 Apache Tomcat 8.5.54 Apache Tomcat 8.5.55 Apache Tomcat 8.5.56	123
Application	Netapp Netapp Oncommand System Manager 3.0.0 Netapp Oncommand System Manager 3.1 Netapp Oncommand System Manager 3.1.1 Netapp Oncommand System Manager 3.1.2 Netapp Oncommand System Manager 3.1.3	5
Application	Oracle Oracle Managed File Transfer 12.2.1.3.0 Oracle Managed File Transfer 12.2.1.4.0 Oracle Instantis Enterprisetrack 17.1 Oracle Instantis Enterprisetrack 17.2 Oracle Instantis Enterprisetrack 17.3 Oracle Agile PLM 9.3.3 Oracle Agile PLM 9.3.5 Oracle Agile PLM 9.3.6 Oracle Workload Manager 18C Oracle Workload Manager 19C Oracle Workload Manager 12.2.0.1 Oracle Agile Engineering Data Management 6.2.1.0 Oracle Siebel UI Framework - Oracle Siebel UI Framework 8.1.1 Oracle Siebel UI Framework 8.2.2 Oracle Siebel UI Framework 16.0 Oracle Siebel UI Framework 16.1 Oracle Siebel UI Framework 17.0 Oracle Siebel UI Framework 18.0 Oracle Siebel UI Framework 18.7 Oracle Siebel UI Framework 18.8 Oracle Siebel UI Framework 18.9 Oracle Siebel UI Framework 18.10 Oracle Siebel UI Framework 18.11 Oracle Siebel UI Framework 19.0 Oracle Siebel UI Framework 19.7 Oracle Siebel UI Framework 19.8 Oracle Siebel UI Framework 19.10 Oracle Siebel UI Framework 20.1 Oracle Siebel UI Framework 20.2 Oracle Siebel UI Framework 20.5 Oracle Siebel UI Framework 20.6 Oracle Siebel UI Framework 20.8 Oracle Siebel UI Framework 20.12 Oracle Mysql Enterprise Monitor - Oracle Mysql Enterprise Monitor 2.3.14 Oracle Mysql Enterprise Monitor 3.0.4 Oracle Mysql Enterprise Monitor 3.0.25 Oracle Mysql Enterprise Monitor 3.1.0 Oracle Mysql Enterprise Monitor 3.1.1 Oracle Mysql Enterprise Monitor 3.1.2 Oracle Mysql Enterprise Monitor 3.1.3 Oracle Mysql Enterprise Monitor 3.1.3.7856 Oracle Mysql Enterprise Monitor 3.1.4 Oracle Mysql Enterprise Monitor 3.1.5 Oracle Mysql Enterprise Monitor 3.1.6 Oracle Mysql Enterprise Monitor 3.1.6.8003 Oracle Mysql Enterprise Monitor 3.1.7 Oracle Mysql Enterprise Monitor 3.2.0 Oracle Mysql Enterprise Monitor 3.2.1 Oracle Mysql Enterprise Monitor 3.2.2 Oracle Mysql Enterprise Monitor 3.2.3 Oracle Mysql Enterprise Monitor 3.2.4 Oracle Mysql Enterprise Monitor 3.2.5 Oracle Mysql Enterprise Monitor 3.2.6 Oracle Mysql Enterprise Monitor 3.2.7 Oracle Mysql Enterprise Monitor 3.2.8 Oracle Mysql Enterprise Monitor 3.2.8.2223 Oracle Mysql Enterprise Monitor 3.2.9 Oracle Mysql Enterprise Monitor 3.2.10 Oracle Mysql Enterprise Monitor 3.2.1182 Oracle Mysql Enterprise Monitor 3.3.0 Oracle Mysql Enterprise Monitor 3.3.1 Oracle Mysql Enterprise Monitor 3.3.2 Oracle Mysql Enterprise Monitor 3.3.2.1162 Oracle Mysql Enterprise Monitor 3.3.3 Oracle Mysql Enterprise Monitor 3.3.4 Oracle Mysql Enterprise Monitor 3.3.4.3247 Oracle Mysql Enterprise Monitor 3.3.5 Oracle Mysql Enterprise Monitor 3.3.6 Oracle Mysql Enterprise Monitor 3.3.6.3293 Oracle Mysql Enterprise Monitor 3.3.7 Oracle Mysql Enterprise Monitor 3.3.8 Oracle Mysql Enterprise Monitor 3.3.9 Oracle Mysql Enterprise Monitor 3.4.0 Oracle Mysql Enterprise Monitor 3.4.1 Oracle Mysql Enterprise Monitor 3.4.2 Oracle Mysql Enterprise Monitor 3.4.2.4181 Oracle Mysql Enterprise Monitor 3.4.3 Oracle Mysql Enterprise Monitor 3.4.4 Oracle Mysql Enterprise Monitor 3.4.4.4226 Oracle Mysql Enterprise Monitor 3.4.5 Oracle Mysql Enterprise Monitor 3.4.6 Oracle Mysql Enterprise Monitor 3.4.7 Oracle Mysql Enterprise Monitor 3.4.7.4297 Oracle Mysql Enterprise Monitor 3.4.8 Oracle Mysql Enterprise Monitor 3.4.9 Oracle Mysql Enterprise Monitor 3.4.9.4237 Oracle Mysql Enterprise Monitor 3.4.10 Oracle Mysql Enterprise Monitor 4.0.0 Oracle Mysql Enterprise Monitor 4.0.0.5135 Oracle Mysql Enterprise Monitor 4.0.1 Oracle Mysql Enterprise Monitor 4.0.2 Oracle Mysql Enterprise Monitor 4.0.3 Oracle Mysql Enterprise Monitor 4.0.4 Oracle Mysql Enterprise Monitor 4.0.4.5235 Oracle Mysql Enterprise Monitor 4.0.5 Oracle Mysql Enterprise Monitor 4.0.6 Oracle Mysql Enterprise Monitor 4.0.6.5281 Oracle Mysql Enterprise Monitor 4.0.7 Oracle Mysql Enterprise Monitor 4.0.8 Oracle Mysql Enterprise Monitor 4.0.11.5331 Oracle Mysql Enterprise Monitor 4.0.12 Oracle Mysql Enterprise Monitor 4.1 Oracle Mysql Enterprise Monitor 8.0.0 Oracle Mysql Enterprise Monitor 8.0.0.8131 Oracle Mysql Enterprise Monitor 8.0.1 Oracle Mysql Enterprise Monitor 8.0.2 Oracle Mysql Enterprise Monitor 8.0.2.8191 Oracle Mysql Enterprise Monitor 8.0.3 Oracle Mysql Enterprise Monitor 8.0.14 Oracle Mysql Enterprise Monitor 8.0.18.1217 Oracle Mysql Enterprise Monitor 8.0.20 Oracle Mysql Enterprise Monitor 8.0.21 Oracle FMW Platform 12.2.1.4.0 Oracle FMW Platform 12.2.1.3.0 Oracle Communications Instant Messaging Server 10.0.1.5.0	117
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0	2
OS	Opensuse Opensuse Leap 15.1 Opensuse Leap 15.2	2
OS	Canonical Canonical Ubuntu Linux 20.04	1

Common Weakness Enumeration (CWE)

CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References