CVE-2019-0199
- State
- Published
- Severity
- Not scored
- Published
- Apr 10, 2019
- Updated
- Aug 4, 2024
- Reserved
- Nov 14, 2018
Description
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache Tomcatn/a |
|
References
- https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/mailing-list
- https://security.netapp.com/advisory/ntap-20190419-0001/
- [tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199mailing-list
- [tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- [tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- [announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- [tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- [tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xmlmailing-list
- [tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- [tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- [tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- [tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- [announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoSmailing-list
- FEDORA-2019-1a3f878d27vendor-advisory
- https://support.f5.com/csp/article/K17321505
- openSUSE-SU-2019:1673vendor-advisory
- FEDORA-2019-d66febb5dfvendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- 107674vdb-entry
- openSUSE-SU-2019:1723vendor-advisory
- openSUSE-SU-2019:1808vendor-advisory
- RHSA-2019:3929vendor-advisory
- RHSA-2019:3931vendor-advisory
- DSA-4596vendor-advisory
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security updatemailing-list
- https://www.oracle.com/security-alerts/cpujan2020.html
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.