CERT24CVE-2019-10072: Apache Tomcat HTTP/2 connection-window exhaustion can cause denial of serviceLoading data…
CERT24Threat Observatory
Period

CVE-2019-10072: Apache Tomcat HTTP/2 connection-window exhaustion can cause denial of service

The fix for CVE-2019-0199 was incomplete in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 and did not address HTTP/2 connection-window exhaustion on write. Clients could cause server-side threads to block, eventually leading to thread exhaustion and a denial of service.

← Back to intelligence

CVE-2019-10072: Apache Tomcat HTTP/2 connection-window exhaustion can cause denial of service

The fix for CVE-2019-0199 was incomplete in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 and did not address HTTP/2 connection-window exhaustion on write. Clients could cause server-side threads to block, eventually leading to thread exhaustion and a denial of service.