Disclosure summary
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Source-reported weakness categories
NVD-CWE-noinfo
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2020-13943
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| apache | tomcat | 8.5.0 |
| apache | tomcat | 8.5.1 |
| apache | tomcat | 8.5.2 |
| apache | tomcat | 8.5.3 |
| apache | tomcat | 8.5.4 |
| apache | tomcat | 8.5.5 |
| apache | tomcat | 8.5.6 |
| apache | tomcat | 8.5.7 |
| apache | tomcat | 8.5.8 |
| apache | tomcat | 8.5.9 |
| apache | tomcat | 8.5.10 |
| apache | tomcat | 8.5.11 |
| apache | tomcat | 8.5.12 |
| apache | tomcat | 8.5.13 |
| apache | tomcat | 8.5.14 |
| apache | tomcat | 8.5.15 |
| apache | tomcat | 8.5.16 |
| apache | tomcat | 8.5.17 |
| apache | tomcat | 8.5.18 |
| apache | tomcat | 8.5.19 |
| apache | tomcat | 8.5.20 |
| apache | tomcat | 8.5.21 |
| apache | tomcat | 8.5.22 |
| apache | tomcat | 8.5.23 |
| apache | tomcat | 8.5.24 |
| apache | tomcat | 8.5.25 |
| apache | tomcat | 8.5.26 |
| apache | tomcat | 8.5.27 |
| apache | tomcat | 8.5.28 |
| apache | tomcat | 8.5.29 |
| apache | tomcat | 8.5.30 |
| apache | tomcat | 8.5.31 |
| apache | tomcat | 8.5.32 |
| apache | tomcat | 8.5.33 |
| apache | tomcat | 8.5.34 |
| apache | tomcat | 8.5.35 |
| apache | tomcat | 8.5.36 |
| apache | tomcat | 8.5.37 |
| apache | tomcat | 8.5.38 |
| apache | tomcat | 8.5.39 |
| apache | tomcat | 8.5.40 |
| apache | tomcat | 8.5.41 |
| apache | tomcat | 8.5.42 |
| apache | tomcat | 8.5.43 |
| apache | tomcat | 8.5.44 |
| apache | tomcat | 8.5.45 |
| apache | tomcat | 8.5.46 |
| apache | tomcat | 8.5.47 |
| apache | tomcat | 8.5.48 |
| apache | tomcat | 8.5.49 |
| apache | tomcat | 8.5.50 |
| apache | tomcat | 8.5.51 |
| apache | tomcat | 8.5.52 |
| apache | tomcat | 8.5.53 |
| apache | tomcat | 8.5.54 |
| apache | tomcat | 8.5.55 |
| apache | tomcat | 8.5.56 |
| apache | tomcat | 8.5.57 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.1 |
| apache | tomcat | 9.0.2 |
| apache | tomcat | 9.0.3 |
| apache | tomcat | 9.0.4 |
| apache | tomcat | 9.0.5 |
| apache | tomcat | 9.0.6 |
| apache | tomcat | 9.0.7 |
| apache | tomcat | 9.0.8 |
| apache | tomcat | 9.0.9 |
| apache | tomcat | 9.0.10 |
| apache | tomcat | 9.0.11 |
| apache | tomcat | 9.0.12 |
| apache | tomcat | 9.0.13 |
| apache | tomcat | 9.0.14 |
| apache | tomcat | 9.0.15 |
| apache | tomcat | 9.0.16 |
| apache | tomcat | 9.0.17 |
| apache | tomcat | 9.0.18 |
| apache | tomcat | 9.0.19 |
Showing 100 associations; open the original for the complete set.
Original records & references
- NIST NVD record
- CVE Program record
- lists.apache.org — Vendor Advisory
- lists.debian.org — Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- lists.apache.org — Vendor Advisory
- lists.debian.org — Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
PUBLISHED 2020-10-12T10:15:12-04:00
MODIFIED 2026-10-08T18:16:56-04:00
INGESTED 2026-10-10T20:50:19-04:00