The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that wa

Summary

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

Timeline

1. Aug 10, 2017, 10:00 PM UTCCVE published
2. Oct 15, 2024, 5:30 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 15, 2024, 7:01 PM UTCRecord last updated

Affected versions

• Apache Software Foundation Apache Tomcat

  9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6

• org.apache.tomcat:tomcatMaven

  From 9.0.0.M1 · fixed in 9.0.0.M12

• org.apache.tomcat:tomcatMaven

  From 8.5.0 · fixed in 8.5.8

References 8