Medium
Security advisory
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-1935
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:14 UTC · Revision 1
Source evidence
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
osv:CVE-2020-1935
Complete source record
{
"id": "bf3d7f2e4cd16b54ac8c9742d061a31f5c5128099ebd776eaddbbdbbb36ff1aa",
"url": "https://osv.dev/vulnerability/CVE-2020-1935",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-1935",
"summary": "In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.",
"evidence": "osv:CVE-2020-1935",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-1935",
"aliases": [
"BIT-tomcat-2020-1935",
"CVE-2020-1935",
"GHSA-qxf4-chvg-4r8r"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/tomcat",
"type": "GIT",
"events": [
{
"introduced": "e498667bd7811e846771a852b16ce9f1e524b81b"
},
{
"last_affected": "a94a0258f36d064aa032608a9e99c62018f22d94"
},
{
"introduced": "e37b977db6f47e4380ad67114a49e8568951c953"
},
{
"last_affected": "c40ede65ea4fb44b1957ec482f28c7afa71f1b50"
},
{
"introduced": "16bf392c67833ad549733b58c350ff92b5ee782a"
},
{
"last_affected": "4fab4cc012d0c31852e957d198cb0549f3d6074c"
},
{
"last_affected": "16bf392c67833ad549733b58c350ff92b5ee782a"
},
{
"introduced": "29b07def810d335012e738b22ab44d4e232b50d1"
},
{
"last_affected": "45f8fd74cdb96490fab8709263a4d862f0d429cf"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.99"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.50"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0"
},
{
"last_affected": "9.0.30"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-NA"
},
{
"last_affected": "9.0.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone1"
},
{
"last_affected": "9.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone10"
},
{
"last_affected": "9.0.0-milestone10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone11"
},
{
"last_affected": "9.0.0-milestone11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone12"
},
{
"last_affected": "9.0.0-milestone12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone13"
},
{
"last_affected": "9.0.0-milestone13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone14"
},
{
"last_affected": "9.0.0-milestone14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone15"
},
{
"last_affected": "9.0.0-milestone15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone16"
},
{
"last_affected": "9.0.0-milestone16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone17"
},
{
"last_affected": "9.0.0-milestone17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone18"
},
{
"last_affected": "9.0.0-milestone18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone19"
},
{
"last_affected": "9.0.0-milestone19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone2"
},
{
"last_affected": "9.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone20"
},
{
"last_affected": "9.0.0-milestone20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone21"
},
{
"last_affected": "9.0.0-milestone21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone22"
},
{
"last_affected": "9.0.0-milestone22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone23"
},
{
"last_affected": "9.0.0-milestone23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone24"
},
{
"last_affected": "9.0.0-milestone24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone25"
},
{
"last_affected": "9.0.0-milestone25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone26"
},
{
"last_affected": "9.0.0-milestone26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone27"
},
{
"last_affected": "9.0.0-milestone27"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone3"
},
{
"last_affected": "9.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone4"
},
{
"last_affected": "9.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone5"
},
{
"last_affected": "9.0.0-milestone5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone6"
},
{
"last_affected": "9.0.0-milestone6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone7"
},
{
"last_affected": "9.0.0-milestone7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone8"
},
{
"last_affected": "9.0.0-milestone8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone9"
},
{
"last_affected": "9.0.0-milestone9"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"9.0.0-milestone1",
"9.0.0-milestone10",
"9.0.0-milestone11",
"9.0.0-milestone12",
"9.0.0-milestone13",
"9.0.0-milestone14",
"9.0.0-milestone15",
"9.0.0-milestone16",
"9.0.0-milestone17",
"9.0.0-milestone18",
"9.0.0-milestone19",
"9.0.0-milestone2",
"9.0.0-milestone20",
"9.0.0-milestone21",
"9.0.0-milestone22",
"9.0.0-milestone23",
"9.0.0-milestone24",
"9.0.0-milestone25",
"9.0.0-milestone26",
"9.0.0-milestone27",
"9.0.0-milestone3",
"9.0.0-milestone4",
"9.0.0-milestone5",
"9.0.0-milestone6",
"9.0.0-milestone7",
"9.0.0-milestone8",
"9.0.0-milestone9",
"9.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1935.json"
}
}
],
"modified": "2026-10-24T10:31:04.652440460Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/r441c1f30a252bf14b07396286f6abd8089ce4240e91323211f1a2d75%40%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r660cd379afe346f10d72c0eaa8459ccc95d83aff181671b7e9076919%40%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/r80e9c8417c77d52c62809168b96912bda70ddf7748f19f8210f745b1%40%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r9ce7918faf347e7aac32be930bf26c233b0b140fe37af0bb294158b6%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/ra5dee390ad2d60307b8362505c059cd6a726de4d146d63dfce1e05e7%40%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743%40%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/rd547be0c9d821b4b1000a694b8e58ef9f5e2d66db03a31dfe77c4b18%40%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r127f76181aceffea2bd4711b03c595d0f115f63e020348fe925a916c%40%3Cannounce.tomcat.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html",
"https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html",
"https://security.netapp.com/advisory/ntap-20200327-0005/",
"https://usn.ubuntu.com/4448-1/",
"https://www.debian.org/security/2020/dsa-4673",
"https://www.debian.org/security/2020/dsa-4680",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "netapp:oncommand_system_manager",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.1.3"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:instantis_enterprisetrack",
"extracted_events": [
{
"range": [
{
"introduced": "17.1"
},
{
"last_affected": "17.3"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:mysql_enterprise_monitor",
"extracted_events": [
{
"range": [
{
"introduced": "4.0.0"
},
{
"last_affected": "4.0.12"
},
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.20"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:siebel_ui_framework",
"extracted_events": [
{
"range": [
{
"last_affected": "20.5"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:agile_engineering_data_management",
"extracted_events": [
{
"range": [
{
"introduced": "6.2.1.0"
},
{
"last_affected": "6.2.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:agile_product_lifecycle_management",
"extracted_events": [
{
"range": [
{
"introduced": "9.3.3"
},
{
"last_affected": "9.3.3"
},
{
"introduced": "9.3.5"
},
{
"last_affected": "9.3.5"
},
{
"introduced": "9.3.6"
},
{
"last_affected": "9.3.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_element_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.1.1"
},
{
"last_affected": "8.1.1"
},
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.0"
},
{
"introduced": "8.2.1"
},
{
"last_affected": "8.2.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_instant_messaging_server",
"extracted_events": [
{
"range": [
{
"introduced": "10.0.1.4.0"
},
{
"last_affected": "10.0.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.2:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:health_sciences_empirica_inspections",
"extracted_events": [
{
"range": [
{
"introduced": "1.0.1.2"
},
{
"last_affected": "1.0.1.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:health_sciences_empirica_signal:7.3.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:health_sciences_empirica_signal",
"extracted_events": [
{
"range": [
{
"introduced": "7.3.3"
},
{
"last_affected": "7.3.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:hospitality_guest_access",
"extracted_events": [
{
"range": [
{
"introduced": "4.2.0"
},
{
"last_affected": "4.2.0"
},
{
"introduced": "4.2.1"
},
{
"last_affected": "4.2.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:hyperion_infrastructure_technology",
"extracted_events": [
{
"range": [
{
"introduced": "11.1.2.4"
},
{
"last_affected": "11.1.2.4"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_order_broker",
"extracted_events": [
{
"range": [
{
"introduced": "15.0"
},
{
"last_affected": "15.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:transportation_management",
"extracted_events": [
{
"range": [
{
"introduced": "6.3.7"
},
{
"last_affected": "6.3.7"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:workload_manager",
"extracted_events": [
{
"range": [
{
"introduced": "12.2.0.1"
},
{
"last_affected": "12.2.0.1"
},
{
"introduced": "18c"
},
{
"last_affected": "18c"
},
{
"introduced": "19c"
},
{
"last_affected": "19c"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-1935",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 440573,
"published_at": "2020-02-24T22:15:11.98+00:00"
}