CVE-2020-11996 PoC — Apache Tomcat 资源管理错误漏洞

Source

https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996

Associated Vulnerability

Title:Apache Tomcat 资源管理错误漏洞 (CVE-2020-11996)
Description:A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Description

tomcat-embed-core-9.0.31 CVE-2020-11996 Test PoC

Readme

Please see the PoC in testImplicitCloseLargeId unit test of TestHttp2Section_5_1.java: https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section_5_1.java

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!