The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames

Summary

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Timeline

1. Apr 10, 2019, 2:21 PM UTCCVE published
2. Aug 4, 2024, 5:44 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Apache Tomcat

  Version range not reported

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.0 · fixed in 9.0.16

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.0.0 · fixed in 8.5.38

• org.apache.tomcat:tomcat-coyoteMaven

  From 9.0.0 · fixed in 9.0.16

• org.apache.tomcat:tomcat-coyoteMaven

  From 8.0.0 · fixed in 8.5.38

References 25