Skip to content
OpenAdvisories
High · 7.5 CVE-2017-5650 EUVD-2022-3312GHSA-9785-w233-x6hv

Improper Resource Shutdown or Release in Apache Tomcat

Published Apr 17, 2017 · Updated Aug 5, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat Ecosystem: Maven

Description

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat >= 9.0.0.M1, < 9.0.0.M19 9.0.0.M19 GHSA-9785-w233-x6hv
Maven org.apache.tomcat:tomcat >= 8.5.0, < 8.5.13 8.5.13 GHSA-9785-w233-x6hv

Advisories 1

References