The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8 | May 21, 2019 | Apr 10, 2019 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.38Upgrade Apache Tomcat to 9.0.16Upgrade Apache Tomcat to the latest available version | Apr 10, 2019 | Apr 10, 2019 |
| Debian | — | Upgrade tomcat9 | Dec 30, 2019 | Apr 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-lib | Jul 26, 2019 | Apr 10, 2019 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.39-11.4.9.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.39-11.4.9.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.39-11.4.9.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3 | May 30, 2019 | Apr 10, 2019 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2019 |
| Suse | — | Upgrade tomcat-jsp-2_3-apiUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-embedUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-lib | Jul 2, 2019 | Apr 10, 2019 |
| Ubuntu | — | Upgrade tomcat8 | Sep 11, 2019 | Apr 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub