CVE-2020-13934 Overview
CVE-2020-13934 is a memory leak vulnerability in Apache Tomcat that occurs during HTTP/2 upgrade connections. When an h2c (HTTP/2 cleartext) direct connection is established, the HTTP/1.1 processor is not properly released after the upgrade to HTTP/2. This resource management flaw allows attackers to exhaust server memory by initiating a sufficient number of h2c upgrade requests, ultimately causing an OutOfMemoryException and leading to a denial of service condition.
Critical Impact
Attackers can render Apache Tomcat servers unavailable by exhausting memory resources through repeated h2c connection upgrades, requiring no authentication or user interaction.
Affected Products
- Apache Tomcat 10.0.0-M1 to 10.0.0-M6
- Apache Tomcat 9.0.0.M5 to 9.0.36
- Apache Tomcat 8.5.1 to 8.5.56
- Debian Linux 9.0 and 10.0
- openSUSE Leap 15.1 and 15.2
- Canonical Ubuntu Linux 20.04 LTS
- Oracle Agile Engineering Data Management 6.2.1.0
- Oracle Agile PLM 9.3.3, 9.3.5, and 9.3.6
- Oracle Communications Instant Messaging Server 10.0.1.5.0
- Oracle FMW Platform 12.2.1.3.0 and 12.2.1.4.0
- Oracle Instantis EnterpriseTrack 17.1, 17.2, and 17.3
- Oracle Managed File Transfer 12.2.1.3.0 and 12.2.1.4.0
- Oracle MySQL Enterprise Monitor
- Oracle Siebel UI Framework
- Oracle Workload Manager 12.2.0.1, 18c, and 19c
- NetApp OnCommand System Manager
Discovery Timeline
- July 14, 2020 - CVE-2020-13934 published to NVD
- November 21, 2024 - Last updated in NVD database
Technical Details for CVE-2020-13934
Vulnerability Analysis
This vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a memory leak condition affecting Apache Tomcat's HTTP/2 connection handling mechanism. The flaw exists in the protocol upgrade process where Tomcat transitions from HTTP/1.1 to HTTP/2 over cleartext connections (h2c). During this upgrade, the HTTP/1.1 processor object that handled the initial connection is not properly released from memory. This creates a situation where each h2c upgrade request leaves orphaned processor objects consuming JVM heap memory.
The vulnerability is exploitable over the network without requiring any authentication or user interaction. An attacker can systematically exhaust server memory by establishing numerous h2c direct connections, causing the Java Virtual Machine to throw an OutOfMemoryException. This results in service degradation and ultimately complete denial of service as the Tomcat instance becomes unresponsive.
Root Cause
The root cause lies in improper resource management within Tomcat's HTTP/2 upgrade handling code. When a client initiates an h2c upgrade from HTTP/1.1 to HTTP/2, the server creates a new HTTP/2 processor to handle the upgraded connection. However, the original HTTP/1.1 processor that facilitated the upgrade is not correctly dereferenced or cleaned up, preventing garbage collection from reclaiming the associated memory. This missing cleanup step creates a memory leak that accumulates with each upgrade request.
Attack Vector
The attack can be conducted remotely over the network by any unauthenticated attacker. The exploitation method involves sending multiple HTTP/1.1 requests with the appropriate headers to initiate h2c protocol upgrades. Each upgrade leaves behind unreleased memory, and by sustaining a high volume of such requests, an attacker can progressively exhaust the available heap memory allocated to the Tomcat JVM. The attack requires no special privileges and can be automated using simple HTTP client tools.
The typical attack flow involves:
- Establishing an HTTP/1.1 connection to the target Tomcat server
- Sending an upgrade request with HTTP/2 cleartext (h2c) headers
- Repeating this process across multiple connections
- Continuing until server memory is exhausted and an OutOfMemoryException occurs
Detection Methods for CVE-2020-13934
Indicators of Compromise
- Unusual increase in HTTP/2 upgrade requests (h2c) in access logs
- JVM heap memory utilization consistently increasing without corresponding traffic growth
- OutOfMemoryException errors in Tomcat's catalina.out or application logs
- Server response times degrading over time without apparent cause
- Elevated number of connections in the h2c upgrade state
Detection Strategies
- Monitor JVM heap usage metrics for Tomcat instances using JMX or application performance monitoring tools
- Configure alerts for OutOfMemoryException patterns in log aggregation systems
- Implement rate limiting on HTTP/2 upgrade requests at the load balancer or reverse proxy level
- Analyze network traffic for abnormal volumes of HTTP upgrade requests targeting Tomcat endpoints
Monitoring Recommendations
- Deploy memory monitoring dashboards tracking Tomcat JVM heap usage trends over time
- Set up threshold-based alerts when memory utilization exceeds 80% for sustained periods
- Enable verbose garbage collection logging to identify memory leak patterns
- Review HTTP access logs for patterns of repeated upgrade requests from single sources
How to Mitigate CVE-2020-13934
Immediate Actions Required
- Upgrade Apache Tomcat to a patched version: 10.0.0-M7 or later, 9.0.37 or later, or 8.5.57 or later
- If immediate patching is not possible, disable HTTP/2 support temporarily by removing the h2c protocol from the connector configuration
- Implement rate limiting for HTTP upgrade requests at the network edge
- Monitor memory usage closely and configure automatic restarts if memory thresholds are exceeded
Patch Information
Apache has released fixed versions addressing this vulnerability. Upgrade to the following versions or later:
- Apache Tomcat 10.0.0-M7 or later for the 10.x branch
- Apache Tomcat 9.0.37 or later for the 9.x branch
- Apache Tomcat 8.5.57 or later for the 8.5.x branch
Refer to the Apache Tomcat Announcement for official patch details. Linux distribution users should consult the Debian Security Advisory and Ubuntu Security Notice for distribution-specific updates. Oracle product users should review the Oracle October 2020 CPU and subsequent Critical Patch Updates for bundled Tomcat updates.
Workarounds
- Disable h2c support by removing the h2c protocol from the <UpgradeProtocol> element in server.xml
- Configure a reverse proxy or load balancer to block or rate-limit HTTP upgrade requests
- Implement connection limits per client IP address to reduce the attack surface
- Increase JVM heap allocation as a temporary measure while scheduling patching maintenance
# Disable h2c in Tomcat server.xml connector configuration
# Remove or comment out the UpgradeProtocol line for h2c
# Before (vulnerable):
# <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
#
# After (mitigated):
# Comment out or remove the h2c upgrade protocol
# Alternatively, configure only encrypted HTTP/2 (h2) via HTTPS connector
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
