{"id":"CVE-2019-0199","published":"2019-04-10T14:21:50Z","modified":"2024-08-04T17:44:15Z","title":"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"Apache Tomcat","versions":["Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37"]}],"description":{"text":"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","provenance":"source","from":"CVE.org"},"summary":{"text":"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 through 9.0.14 and 8.5.0 through 8.5.37 accepts streams carrying excessive numbers of SETTINGS frames and lets clients hold streams open without reading or writing request or response data. A remote client that keeps such streams open for requests using the Servlet API's blocking I/O can cause server threads to block until they are exhausted, producing a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:41Z"},"cvss":null,"epss":{"score":0.72855,"percentile":0.99449,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.netapp.com/advisory/ntap-20190419-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://support.f5.com/csp/article/K17321505","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/107674","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.debian.org/security/2019/dsa-4596","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0, <9.0.16",">=8.0.0, <8.5.38"],"patched":["9.0.16","8.5.38"],"from":["GHSA-qcxh-w3j9-58qr"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=9.0.0, <9.0.16",">=8.0.0, <8.5.38"],"patched":["9.0.16","8.5.38"],"from":["GHSA-qcxh-w3j9-58qr"],"provenance":"source"}],"advisories":[{"id":"GHSA-qcxh-w3j9-58qr","url":"https://github.com/advisories/GHSA-qcxh-w3j9-58qr","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0, <9.0.16"],"patched":["9.0.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-qcxh-w3j9-58qr","url":"https://github.com/advisories/GHSA-qcxh-w3j9-58qr","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=8.0.0, <8.5.38"],"patched":["8.5.38"],"provenance":"source","from":"GHSA"},{"id":"GHSA-qcxh-w3j9-58qr","url":"https://github.com/advisories/GHSA-qcxh-w3j9-58qr","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=9.0.0, <9.0.16"],"patched":["9.0.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-qcxh-w3j9-58qr","url":"https://github.com/advisories/GHSA-qcxh-w3j9-58qr","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=8.0.0, <8.5.38"],"patched":["8.5.38"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0508","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0508","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2019-04-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-0199","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9945"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-5650","children":[{"from":"CVE-2019-0199","to":"CVE-2019-10072","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 .","from":"CVE.org","in":"CVE-2019-10072"}]}],"packageHistory":[{"cve":"CVE-2023-34981","published":"2023-06-21","fixed":"8.5.89","kev":false},{"cve":"CVE-2016-6816","published":"2017-03-20","fixed":"9.0.0.M12","kev":false},{"cve":"CVE-2017-5651","published":"2017-04-17","fixed":"9.0.0.M19","kev":false,"link":{"from":"CVE-2017-5651","to":"CVE-2019-0199","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"8.5.13","toFixed":"8.5.38","daysApart":723}]}},{"cve":"CVE-2019-0199","published":"2019-04-10","fixed":"9.0.16","kev":false},{"cve":"CVE-2024-21733","published":"2024-01-19","fixed":"9.0.44","kev":false},{"cve":"CVE-2023-42794","published":"2023-10-10","fixed":"9.0.81","kev":false},{"cve":"CVE-2025-52434","published":"2025-07-10","fixed":"9.0.107","kev":false},{"cve":"CVE-2020-13934","published":"2020-07-14","fixed":"10.0.0-M6","kev":false,"link":{"from":"CVE-2019-0199","to":"CVE-2020-13934","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.16","toFixed":"9.0.36","daysApart":461},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"8.5.38","toFixed":"8.5.56","daysApart":461}]}}],"package":"Maven:org.apache.tomcat:tomcat-coyote"}}