The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.41Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.20 | Jun 21, 2019 | Jun 21, 2019 |
| Debian | — | Upgrade tomcat9 | May 8, 2020 | Jun 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-api | Sep 30, 2019 | Jun 21, 2019 |
| Oracle Missing Cpu Jan 2020 | — | Apply the January 2020 Critical Patch Update (CPU) for Oracle Database | Jan 20, 2020 | Jun 21, 2019 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.42-11.4.12.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.42-11.4.12.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.42-11.4.12.0.1.2.0 on Solaris 11.4 | Aug 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2019 |
| Suse | — | Upgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-embedUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-jsp-2_3-api | Jul 18, 2019 | Jun 21, 2019 |
| Ubuntu | — | Upgrade tomcat9Upgrade libtomcat9-javaUpgrade libtomcat8-javaUpgrade tomcat8 | Sep 11, 2019 | Jun 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub