CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2019-0199
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Severity
- EPSS
- 73% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qcxh-w3j9-58qr | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=9.0.0 <9.0.16 | 9.0.16 |
| GHSA-qcxh-w3j9-58qr | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=8.0.0 <8.5.38 | 8.5.38 |
| GHSA-qcxh-w3j9-58qr | Maven | org.apache.tomcat:tomcat-coyote | >=9.0.0 <9.0.16 | 9.0.16 |
| GHSA-qcxh-w3j9-58qr | Maven | org.apache.tomcat:tomcat-coyote | >=8.0.0 <8.5.38 | 8.5.38 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html
- http://www.securityfocus.com/bid/107674
- https://access.redhat.com/errata/RHSA-2019:3929