The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-api | May 29, 2024 | Mar 13, 2024 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-3.1-apiUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webapps | Apr 18, 2024 | Mar 13, 2024 |
| Amazon_linux | — | Upgrade tomcat8 | Jun 24, 2024 | Mar 13, 2024 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.86Upgrade Apache Tomcat to 8.5.99Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to 10.1.19 | Mar 14, 2024 | Mar 13, 2024 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Dec 13, 2024 | Nov 19, 2024 |
| Debian | — | Upgrade tomcat9Upgrade tomcat10 | Apr 8, 2024 | Mar 13, 2024 |
| Oracle_linux | — | Upgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webapps | May 24, 2024 | Mar 13, 2024 |
| Redhat_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiNo solution existsUpgrade tomcat-lib | May 24, 2024 | Mar 13, 2024 |
| Suse | — | Upgrade apache-commons-pool2Upgrade geronimo-ws-metadata-2_0-apiUpgrade tomcat10-jsvcUpgrade geronimo-interceptor-3_0-apiUpgrade tomcat10-docs-webappUpgrade tomcat10-servlet-6_0-apiUpgrade geronimo-el-1_0-apiUpgrade apache-commons-dbcp-javadocUpgrade geronimo-j2ee-connector-1_5-apiUpgrade geronimo-jta-1_0_1B-apiUpgrade geronimo-jsp-2_1-apiUpgrade geronimo-j2ee-deployment-1_1-apiUpgrade geronimo-jaxrpc-1_1-apiUpgrade tomcat10-el-5_0-apiUpgrade geronimo-corba-2_3-apisUpgrade geronimo-corba-1_0-apisUpgrade geronimo-jacc-1_0-apiUpgrade geronimo-qname-1_1-apiUpgrade tomcat10-webappsUpgrade geronimo-j2ee-1_4-apisUpgrade apache-commons-daemonUpgrade geronimo-jms-1_1-apiUpgrade geronimo-ejb-3_0-apiUpgrade geronimo-jaf-1_0_2-apiUpgrade apache-commons-daemon-jsvcUpgrade tomcat-docs-webappUpgrade geronimo-servlet-2_4-apiUpgrade tomcat-jsvcUpgrade geronimo-javamail-1_4-apiUpgrade tomcatUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-libUpgrade geronimo-annotation-1_0-apiUpgrade geronimo-jpa-3_0-apiUpgrade geronimo-saaj-1_1-apiUpgrade geronimo-servlet-2_5-apiUpgrade geronimo-jta-1_1-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-embedUpgrade jakarta-taglibs-standardUpgrade tomcat10-jsp-3_1-apiUpgrade geronimo-commonj-1_1-apisUpgrade geronimo-jaf-1_1-apiUpgrade geronimo-j2ee-management-1_1-apiUpgrade geronimo-jsp-2_0-apiUpgrade geronimo-ejb-2_1-apiUpgrade apache-commons-daemon-javadocUpgrade geronimo-jacc-1_1-apiUpgrade tomcat10-admin-webappsUpgrade apache-commons-pool2-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade geronimo-stax-1_0-apiUpgrade geronimo-javamail-1_3_1-apiUpgrade geronimo-j2ee-management-1_0-apiUpgrade tomcat10Upgrade tomcat10-libUpgrade jakarta-taglibs-standard-javadocUpgrade apache-commons-dbcpUpgrade tomcat-webappsUpgrade tomcat10-embedUpgrade geronimo-javaee-deployment-1_1-apiUpgrade geronimo-jaxr-1_0-apiUpgrade tomcat10-doc | Apr 12, 2024 | Mar 13, 2024 |
| Ubuntu | — | Upgrade libtomcat10-java (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro)Upgrade tomcat10 (Ubuntu Pro)Upgrade libtomcat9-javaUpgrade tomcat8 (Ubuntu Pro)Upgrade libtomcat9-java (Ubuntu Pro) | Jun 11, 2025 | Mar 13, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub