The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | amazon-linux-upgrade-tomcat8 | May 21, 2019 | Apr 10, 2019 |
| Apache Tomcat | apache-tomcat-upgrade-8_5_38apache-tomcat-upgrade-9_0_16apache-tomcat-upgrade-latest | Apr 10, 2019 | Apr 10, 2019 | |
| Debian | debian-upgrade-tomcat9 | Dec 30, 2019 | Apr 10, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tomcathuawei-euleros-2_0_sp8-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp8-upgrade-tomcat-el-3.0-apihuawei-euleros-2_0_sp8-upgrade-tomcat-jsp-2.3-apihuawei-euleros-2_0_sp8-upgrade-tomcat-libhuawei-euleros-2_0_sp8-upgrade-tomcat-servlet-4.0-api | Jul 26, 2019 | Apr 10, 2019 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-8-5-51-0-175-3-36-0-20-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-51-0-175-3-36-0-20-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-51-0-175-3-36-0-20-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-39-11-4-9-0-1-2-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-39-11-4-9-0-1-2-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-39-11-4-9-0-1-2-0 | May 30, 2019 | Apr 10, 2019 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Apr 10, 2019 | |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Jul 2, 2019 | Apr 10, 2019 |
| Ubuntu | ubuntu-upgrade-tomcat8 | Sep 11, 2019 | Apr 10, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Apr 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub