{"action":"Upgrade org.apache.tomcat:tomcat to 7.0.105 (7.x), 8.5.57 (8.x), 9.0.37 (9.x) or 10.0.0-M7 (10.x) or later.","affected":[{"fixed":"10.0.0-M7","introduced":"10.0.0-M1"},{"fixed":"9.0.37","introduced":"9.0.0.M1"},{"fixed":"8.5.57","introduced":"8.5.0"},{"fixed":"7.0.105","introduced":"7.0.27"}],"component":"org.apache.tomcat:tomcat","cve_ids":["CVE-2020-13935"],"ecosystem":"Maven","epss":0.86608,"exploited":false,"fixed_versions":["10.0.0-M7","9.0.37","8.5.57","7.0.105"],"ghsa_id":"GHSA-m7jv-hq7h-mq7c","id":"tcs_01M5N94MRX4FSX5F0HA4SYNENN","modified_at":"2026-08-26T01:18:35.514741429Z","published_at":"2022-02-08T22:05:17Z","references":["https://osv.dev/vulnerability/GHSA-m7jv-hq7h-mq7c","https://nvd.nist.gov/vuln/detail/CVE-2020-13935","https://github.com/apache/tomcat/commit/12d715676038efbf9c728af10163f8277fc019d5","https://github.com/apache/tomcat/commit/1c1c77b0efb667cea80b532440b44cea1dc427c3","https://github.com/apache/tomcat/commit/40fa74c74822711ab878079d0a69f7357926723d","https://github.com/apache/tomcat/commit/4c04982870d6e730c38e21e58fb653b7cf723784","https://github.com/apache/tomcat/commit/f9f75c14678b68633f79030ddf4ff827f014cc84","https://tomcat.apache.org/security-9.html","https://usn.ubuntu.com/4448-1","https://usn.ubuntu.com/4596-1","https://www.debian.org/security/2020/dsa-4727","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://tomcat.apache.org/security-8.html","https://tomcat.apache.org/security-7.html","https://tomcat.apache.org/security-10.html","https://security.netapp.com/advisory/ntap-20200724-0003","https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50@%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E","https://kc.mcafee.com/corporate/index?page=content&id=SB10332","https://github.com/apache/tomcat","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-m7jv-hq7h-mq7c","url":"https://osv.dev/vulnerability/GHSA-m7jv-hq7h-mq7c"}],"summary":"Infinite Loop in Apache Tomcat"}