© 2026 vulntracker.io

CVE-2019-10072

N/A

Published: June 21, 2019 at 05:56 PM UTC

Updated: June 17, 2026 at 02:10 AM UTC

1 product affected across 1 vendorTomcat

Using Apache Tomcat by N/A?

Get instant alerts when new vulnerabilities affect Apache Tomcat - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 73%

Description

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (20)

Vendor Advisoryx_refsource_SUSE

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html

VDB Entryx_refsource_BID

Source: [email protected]

http://www.securityfocus.com/bid/108874

Vendor Advisoryx_refsource_REDHAT

Source: [email protected]

https://access.redhat.com/errata/RHSA-2019:3929

Vendor Advisoryx_refsource_REDHAT

Source: [email protected]

https://access.redhat.com/errata/RHSA-2019:3931

x_refsource_MISC

Source: [email protected]

https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E

Mailing Listx_refsource_MLIST

Source: [email protected]

https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

Mailing Listx_refsource_MLIST

Source: [email protected]

https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

Mailing Listx_refsource_MLIST

Source: [email protected]

https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

CVSS

5MEDIUM[email protected]

Confidentiality: NONE
Integrity: NONE
Availability: PARTIAL

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-667

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card