CVE-2020-13934: Apache Tomcat HTTP/2 DoS Vulnerability

CVE-2020-13934 Overview

CVE-2020-13934 is a memory leak vulnerability in Apache Tomcat that occurs during HTTP/2 upgrade connections. When an h2c (HTTP/2 cleartext) direct connection is established, the HTTP/1.1 processor is not properly released after the upgrade to HTTP/2. This resource management flaw allows attackers to exhaust server memory by initiating a sufficient number of h2c upgrade requests, ultimately causing an OutOfMemoryException and leading to a denial of service condition.

Critical Impact
Attackers can render Apache Tomcat servers unavailable by exhausting memory resources through repeated h2c connection upgrades, requiring no authentication or user interaction.

Affected Products

Apache Tomcat 10.0.0-M1 to 10.0.0-M6
Apache Tomcat 9.0.0.M5 to 9.0.36
Apache Tomcat 8.5.1 to 8.5.56
Debian Linux 9.0 and 10.0
openSUSE Leap 15.1 and 15.2
Canonical Ubuntu Linux 20.04 LTS
Oracle Agile Engineering Data Management 6.2.1.0
Oracle Agile PLM 9.3.3, 9.3.5, and 9.3.6
Oracle Communications Instant Messaging Server 10.0.1.5.0
Oracle FMW Platform 12.2.1.3.0 and 12.2.1.4.0
Oracle Instantis EnterpriseTrack 17.1, 17.2, and 17.3
Oracle Managed File Transfer 12.2.1.3.0 and 12.2.1.4.0
Oracle MySQL Enterprise Monitor
Oracle Siebel UI Framework
Oracle Workload Manager 12.2.0.1, 18c, and 19c
NetApp OnCommand System Manager

Discovery Timeline

July 14, 2020 - CVE-2020-13934 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-13934

Vulnerability Analysis

This vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a memory leak condition affecting Apache Tomcat's HTTP/2 connection handling mechanism. The flaw exists in the protocol upgrade process where Tomcat transitions from HTTP/1.1 to HTTP/2 over cleartext connections (h2c). During this upgrade, the HTTP/1.1 processor object that handled the initial connection is not properly released from memory. This creates a situation where each h2c upgrade request leaves orphaned processor objects consuming JVM heap memory.

The vulnerability is exploitable over the network without requiring any authentication or user interaction. An attacker can systematically exhaust server memory by establishing numerous h2c direct connections, causing the Java Virtual Machine to throw an OutOfMemoryException. This results in service degradation and ultimately complete denial of service as the Tomcat instance becomes unresponsive.

Root Cause

The root cause lies in improper resource management within Tomcat's HTTP/2 upgrade handling code. When a client initiates an h2c upgrade from HTTP/1.1 to HTTP/2, the server creates a new HTTP/2 processor to handle the upgraded connection. However, the original HTTP/1.1 processor that facilitated the upgrade is not correctly dereferenced or cleaned up, preventing garbage collection from reclaiming the associated memory. This missing cleanup step creates a memory leak that accumulates with each upgrade request.

Attack Vector

The attack can be conducted remotely over the network by any unauthenticated attacker. The exploitation method involves sending multiple HTTP/1.1 requests with the appropriate headers to initiate h2c protocol upgrades. Each upgrade leaves behind unreleased memory, and by sustaining a high volume of such requests, an attacker can progressively exhaust the available heap memory allocated to the Tomcat JVM. The attack requires no special privileges and can be automated using simple HTTP client tools.

The typical attack flow involves:

Establishing an HTTP/1.1 connection to the target Tomcat server
Sending an upgrade request with HTTP/2 cleartext (h2c) headers
Repeating this process across multiple connections
Continuing until server memory is exhausted and an OutOfMemoryException occurs

Detection Methods for CVE-2020-13934

Indicators of Compromise

Unusual increase in HTTP/2 upgrade requests (h2c) in access logs
JVM heap memory utilization consistently increasing without corresponding traffic growth
OutOfMemoryException errors in Tomcat's catalina.out or application logs
Server response times degrading over time without apparent cause
Elevated number of connections in the h2c upgrade state

Detection Strategies

Monitor JVM heap usage metrics for Tomcat instances using JMX or application performance monitoring tools
Configure alerts for OutOfMemoryException patterns in log aggregation systems
Implement rate limiting on HTTP/2 upgrade requests at the load balancer or reverse proxy level
Analyze network traffic for abnormal volumes of HTTP upgrade requests targeting Tomcat endpoints

Monitoring Recommendations

Deploy memory monitoring dashboards tracking Tomcat JVM heap usage trends over time
Set up threshold-based alerts when memory utilization exceeds 80% for sustained periods
Enable verbose garbage collection logging to identify memory leak patterns
Review HTTP access logs for patterns of repeated upgrade requests from single sources

How to Mitigate CVE-2020-13934

Immediate Actions Required

Upgrade Apache Tomcat to a patched version: 10.0.0-M7 or later, 9.0.37 or later, or 8.5.57 or later
If immediate patching is not possible, disable HTTP/2 support temporarily by removing the h2c protocol from the connector configuration
Implement rate limiting for HTTP upgrade requests at the network edge
Monitor memory usage closely and configure automatic restarts if memory thresholds are exceeded

Patch Information

Apache has released fixed versions addressing this vulnerability. Upgrade to the following versions or later:

Apache Tomcat 10.0.0-M7 or later for the 10.x branch
Apache Tomcat 9.0.37 or later for the 9.x branch
Apache Tomcat 8.5.57 or later for the 8.5.x branch

Refer to the Apache Tomcat Announcement for official patch details. Linux distribution users should consult the Debian Security Advisory and Ubuntu Security Notice for distribution-specific updates. Oracle product users should review the Oracle October 2020 CPU and subsequent Critical Patch Updates for bundled Tomcat updates.

Workarounds

Disable h2c support by removing the h2c protocol from the <UpgradeProtocol> element in server.xml
Configure a reverse proxy or load balancer to block or rate-limit HTTP upgrade requests
Implement connection limits per client IP address to reduce the attack surface
Increase JVM heap allocation as a temporary measure while scheduling patching maintenance

bash

# Disable h2c in Tomcat server.xml connector configuration
# Remove or comment out the UpgradeProtocol line for h2c
# Before (vulnerable):
# <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
#
# After (mitigated):
# Comment out or remove the h2c upgrade protocol
# Alternatively, configure only encrypted HTTP/2 (h2) via HTTPS connector