The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 8.5.41Upgrade Apache Tomcat to 9.0.20 | Jun 21, 2019 | Jun 21, 2019 |
| Debian | — | Upgrade tomcat9 | May 8, 2020 | Jun 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-api | Sep 30, 2019 | Jun 21, 2019 |
| Oracle Missing Cpu Jan 2020 | — | Apply the January 2020 Critical Patch Update (CPU) for Oracle Database | Jan 20, 2020 | Jun 21, 2019 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.42-11.4.12.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.42-11.4.12.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.42-11.4.12.0.1.2.0 on Solaris 11.4 | Aug 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2019 |
| Suse | — | Upgrade tomcat-jsp-2_3-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-libUpgrade tomcat-el-3_0-apiUpgrade tomcat-embedUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcat-admin-webapps | Jul 18, 2019 | Jun 21, 2019 |
| Ubuntu | — | Upgrade libtomcat8-javaUpgrade tomcat8Upgrade tomcat9Upgrade libtomcat9-java | Sep 11, 2019 | Jun 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub