{"id":"CVE-2019-10072","published":"2019-06-21T17:56:42Z","modified":"2024-08-04T22:10:09Z","title":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"Apache Tomcat","versions":["Apache Tomcat 9.0.0.M1 to 9.0.19, 8.5.0 to 8.5.40"]}],"description":{"text":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an incomplete fix for an earlier HTTP/2 issue in Apache Tomcat, where the server fails to send WINDOW_UPDATE messages for the connection-level window (stream 0) during writes, so server-side threads can block and become exhausted. An attacker who can open HTTP/2 connections to an affected Tomcat instance can cause this exhaustion to produce a denial of service, with no authentication or user interaction described as required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:40Z"},"cvss":null,"epss":{"score":0.72988,"percentile":0.99453,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/108874","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://usn.ubuntu.com/4128-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/4128-2/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2020/dsa-4680","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_29","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20190625-0002/","tags":["x_refsource_CONFIRM"]},{"url":"https://support.f5.com/csp/article/K17321505","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0.M1, <9.0.20",">=8.5.0, <8.5.41"],"patched":["9.0.20","8.5.41"],"from":["GHSA-q4hg-rmq2-52q9"],"provenance":"source"}],"advisories":[{"id":"GHSA-q4hg-rmq2-52q9","url":"https://github.com/advisories/GHSA-q4hg-rmq2-52q9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0.M1, <9.0.20"],"patched":["9.0.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-q4hg-rmq2-52q9","url":"https://github.com/advisories/GHSA-q4hg-rmq2-52q9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=8.5.0, <8.5.41"],"patched":["8.5.41"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2019-0558","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0558","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2019-06-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-10072","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9945"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-org-apache-tomcat-embed-tomcat-embed-cor-cve-2019-0199","parents":[{"from":"CVE-2019-0199","to":"CVE-2019-10072","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 .","from":"CVE.org","in":"CVE-2019-10072"}]}],"packageHistory":[{"cve":"CVE-2019-0199","published":"2019-04-10","fixed":"9.0.16","kev":false},{"cve":"CVE-2019-0221","published":"2019-05-28","fixed":"9.0.17","kev":false,"link":{"from":"CVE-2019-0221","to":"CVE-2019-10072","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.5.40","toFixed":"8.5.41","daysApart":24},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"9.0.17","toFixed":"9.0.20","daysApart":24}]}},{"cve":"CVE-2019-0232","published":"2019-04-15","fixed":"9.0.17","kev":false},{"cve":"CVE-2019-10072","published":"2019-06-21","fixed":"9.0.20","kev":false},{"cve":"CVE-2019-12418","published":"2019-12-23","fixed":"9.0.29","kev":false,"link":{"from":"CVE-2019-10072","to":"CVE-2019-12418","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.5.41","toFixed":"8.5.49","daysApart":185},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"9.0.20","toFixed":"9.0.29","daysApart":185}]}},{"cve":"CVE-2019-17563","published":"2019-12-23","fixed":"9.0.30","kev":false},{"cve":"CVE-2019-17569","published":"2020-02-24","fixed":"9.0.31","kev":false}],"package":"Maven:org.apache.tomcat.embed:tomcat-embed-core"}}