p PatchFirst

CVE-2019-0199

CVE-2019-0199

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

CVSS 7.5 · High · EPSS 72.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37: Affected

    No fix published

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.16-1

    Update to 9.0.16-1

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.16-1

    Update to 9.0.16-1

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.16-1

    Update to 9.0.16-1

  • tomcat8 Ubuntu:18.04:LTS

    Versions
    • 8.5.21-1ubuntu1
    • 8.5.29-1
    • 8.5.30-1
    • 8.5.30-1ubuntu1
    • 8.5.30-1ubuntu1.2
    • 8.5.30-1ubuntu1.3
    • 8.5.30-1ubuntu1.4
    Affected ranges
    • ECOSYSTEM: < 8.5.39-1ubuntu1~18.04.1

    Update to 8.5.39-1ubuntu1~18.04.1

Original sources

Check your server →