The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1

Summary

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Timeline

1. Jun 21, 2019, 5:56 PM UTCCVE published
2. Aug 4, 2024, 10:10 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Apache Tomcat

  Version range not reported

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.0.M1 · fixed in 9.0.20

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.5.0 · fixed in 8.5.41

References 20