CVE-2020-17527 | Apache Tomcat: Request header mix-up between HTTP/2 streams

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

Published: 2020-12-03 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2020-17527 is rated High Risk (69.2/100): CVSS High severity, with high exploitation likelihood (EPSS 24.62%, 98th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +14.12% over the last day, indicating growing attacker interest. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2020-17527

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 10.51% 24.62% +14.12%
2 2026-03-04 5.86% 10.51% +4.64%
3 2026-03-01 — 5.86% —

Full EPSS history (50 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2020-17527

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 3.6 [email protected]
5.0 2.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:N)
No availability impact.
 10.0 2.9 [email protected]

Weakness enumeration for CVE-2020-17527

GitHub Security Advisory for CVE-2020-17527

GHSA-vvw4-rfwf-p6hx · Severity: high · Ecosystem: maven — Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

OS Trackers for CVE-2020-17527

vendor priority summary link
debian not yet assigned CVE-2020-17527 not yet assigned priority: Debian including 1 source packages (tomcat9), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2020-17527
gentoo low CVE-2020-17527: 1 GLSA(s) (202012-23), 1 atom(s) (www-servers/tomcat); latest impact low. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2020-17527
redhat medium — https://access.redhat.com/security/cve/CVE-2020-17527
suse high CVE-2020-17527 severity important: SUSE including 371 source package names (5.0.0-beta1.2.122:tomcat-9.0.36-3.18.1, 5.0.0-beta1.2.122:tomcat-el-3_0-api-9.0.36-3.18.1, …), 672 product×package rows across 64 product lines (Container containers/apache-tomcat, Container suse/manager/5.0/x86_64/server, … (64 product lines)): Fixed 326, Known Affected 231, Known Not Affected 115. https://www.suse.com/security/cve/CVE-2020-17527/
ubuntu medium CVE-2020-17527 medium priority: Ubuntu including 2 source packages (tomcat8, tomcat9), 32 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 15, not-affected 11, released 3, ignored 1, needed 1, needs-triage 1. https://ubuntu.com/security/CVE-2020-17527

Affected software / configurations for CVE-2020-17527

Vendor Product Version Raw CPE
apache tomcat >= 8.5.1, <= 8.5.59 cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat >= 9.0.1, <= 9.0.35 cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
apache tomcat 9.0.0 cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
apache tomcat 9.0.35-3.39.1 cpe:2.3:a:apache:tomcat:9.0.35-3.39.1:*:*:*:*:*:*:*
apache tomcat 9.0.35-3.57.3 cpe:2.3:a:apache:tomcat:9.0.35-3.57.3:*:*:*:*:*:*:*
apache tomcat 9.0.36 cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*
apache tomcat 9.0.37 cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*
apache tomcat 9.0.38 cpe:2.3:a:apache:tomcat:9.0.38:*:*:*:*:*:*:*
apache tomcat 9.0.39 cpe:2.3:a:apache:tomcat:9.0.39:*:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*
apache tomcat 10.0.0 cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*
netapp element_plug-in — cpe:2.3:a:netapp:element_plug-in:-:*:*:*:*:vcenter_server:*:*
netapp oncommand_system_manager >= 3.0.0, <= 3.1.3 cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*
debian debian_linux 9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debian debian_linux 10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
oracle blockchain_platform < 21.1.2 cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
oracle communications_cloud_native_core_binding_support_function 1.10.0 cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_policy 1.14.0 cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
oracle communications_instant_messaging_server 10.0.1.5.0 cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*
oracle instantis_enterprisetrack 17.1 cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
oracle instantis_enterprisetrack 17.2 cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
oracle instantis_enterprisetrack 17.3 cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
oracle mysql_enterprise_monitor < 8.0.23 cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
oracle sd-wan_edge 9.0 cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*
oracle workload_manager 18c cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*
oracle workload_manager 19c cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*

References for CVE-2020-17527

URL Tags
http://www.openwall.com/lists/oss-security/2020/12/03/3 Mailing List Third Party Advisory
https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E Mailing List Vendor Advisory
https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202012-23 Third Party Advisory
https://security.netapp.com/advisory/ntap-20201210-0003/ Third Party Advisory
https://www.debian.org/security/2021/dsa-4835 Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch Third Party Advisory
cvelogic Threat Intelligence