← Back

CVE-2019-10072

nvd nist
Published: Jun 21, 2019Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Affected (29)

Products: Apache: Tomcat
Apache
1 product
Tomcat
Configuration A
29 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Tomcat
From 8.5.0 to 8.5.40
Tomcat
From 9.0.1 to 9.0.19
Tomcat
Version 9.0.0 milestone10
Tomcat
Version 9.0.0 milestone11
Tomcat
Version 9.0.0 milestone12
Tomcat
Version 9.0.0 milestone13
Tomcat
Version 9.0.0 milestone14
Tomcat
Version 9.0.0 milestone15
Tomcat
Version 9.0.0 milestone16
Tomcat
Version 9.0.0 milestone17
Tomcat
Version 9.0.0 milestone18
Tomcat
Version 9.0.0 milestone19
Tomcat
Version 9.0.0 milestone1
Tomcat
Version 9.0.0 milestone20
Tomcat
Version 9.0.0 milestone21
Tomcat
Version 9.0.0 milestone22
Tomcat
Version 9.0.0 milestone23
Tomcat
Version 9.0.0 milestone24
Tomcat
Version 9.0.0 milestone25
Tomcat
Version 9.0.0 milestone26
Tomcat
Version 9.0.0 milestone27
Tomcat
Version 9.0.0 milestone2
Tomcat
Version 9.0.0 milestone3
Tomcat
Version 9.0.0 milestone4
Tomcat
Version 9.0.0 milestone5
Tomcat
Version 9.0.0 milestone6
Tomcat
Version 9.0.0 milestone7
Tomcat
Version 9.0.0 milestone8
Tomcat
Version 9.0.0 milestone9

Related CWEs

CWE-667
Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

References (40)

Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.