CVE-2019-0199: High severity Apache Tomcat vulnerability
A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.
Other sources
A vulnerability was found in Apache Tomcat version from 9.0.0.M1 to 9.0.14 inclusive and 8.5.0 to 8.5.37 inclusive. The HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
References: https://mail-archives.apache.org/modmbox/tomcat-announce/201903.mbox/browser http://tomcat.apache.org/security-9.html http://tomcat.apache.org/security-8.html
— Red Hat
Apache Tomcat is vulnerable to a denial of service, caused by the acceptance of streams with excessive numbers of SETTINGS frames and the permitting of clients to keep streams open without reading/writing request data by the HTTP/2 implementation. By sending excessive SETTINGS frames, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-0199?
CVE-2019-0199 is considered a high severity vulnerability due to the potential for denial of service exploits through excessive SETTINGS frames in HTTP/2.
How do I fix CVE-2019-0199?
To fix CVE-2019-0199, upgrade Apache Tomcat to version 8.5.38 or 9.0.16 or later.
What versions of Apache Tomcat are affected by CVE-2019-0199?
CVE-2019-0199 affects Apache Tomcat versions 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37.
What are the consequences of not addressing CVE-2019-0199?
Failing to address CVE-2019-0199 may lead to potential denial of service through unresponsive streams on affected Apache Tomcat servers.
Is there a workaround for CVE-2019-0199?
There are no known workarounds for CVE-2019-0199; updating to the patched versions is recommended for mitigation.