CVE-2020-13935: 
Java vulnerability analysis and mitigation

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. This vulnerability was discovered and disclosed in July 2020, identified as CVE-2020-13935 (CVE, NVD).

The vulnerability exists in the WebSocket frame processing where invalid payload lengths could trigger an infinite loop. The processRemainingHeader method in WsFrameBase.java expects the most significant bit of the payload length to be 0, otherwise, it gets taken as a negative number and is then endlessly processed (Sonatype).

When successfully exploited, multiple requests with invalid payload lengths could lead to a denial of service (DoS) condition. The vulnerability allows an attacker to cause high CPU usage that will not drop, effectively making the service unavailable (NVD).

The vulnerability is remotely exploitable without requiring authentication. An attacker can trigger the vulnerability by submitting payloads with invalid lengths during a WebSocket session. The original bug report demonstrated how it was possible to achieve a final "payloadLength" calculation of "-2" during a debug exercise, thereby triggering the infinite loop (Sonatype).

Users should upgrade to the following fixed versions: Apache Tomcat 10.x should upgrade to 10.0.0-M7, 9.x should upgrade to 9.0.37, 8.x should upgrade to 8.5.57, and 7.x should upgrade to 7.0.105. The fix implemented checks for negative payload length values and terminates processing if detected (Sonatype).

Multiple vendors and organizations responded to this vulnerability by releasing security advisories and patches, including NetApp, Oracle, Ubuntu, and OpenSUSE (NetApp Advisory, Ubuntu Notice).