CVE-2019-0199 — Apache Tomcat Denial of Service vulnerability

Description

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Affected products

Vendor	Product	Affected	Fixed
—	Apache Tomcat	Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	tomcat9	9.0.16-1	—
Debian 13	tomcat9	9.0.16-1	—
Debian 12	tomcat9	9.0.16-1	—
Debian 9	tomcat8	8.5.50-0+deb9u1	DSA-4596-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	tomcat8	8.5.39-1ubuntu1~18.04.1	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 5	jws5-ecj	4.12.0-1.redhat_1.1.el6jws	RHSA-2019:3929
Red Hat JBoss Web Server 5	jws5-javapackages-tools +1	3.4.1-5.15.11.el6jws	RHSA-2019:3929
Red Hat JBoss Web Server 5	jws5-jboss-logging	3.3.2-1.Final_redhat_00001.1.el6jws	RHSA-2019:3929
Red Hat JBoss Web Server 5	jws5-mod_cluster +1	1.4.1-1.Final_redhat_00001.2.el6jws	RHSA-2019:3929
Red Hat JBoss Web Server 5	jws5-tomcat +9	9.0.21-10.redhat_4.1.el6jws	RHSA-2019:3929
Red Hat JBoss Web Server 5	jws5-tomcat-native	1.2.21-34.redhat_34.el6jws	RHSA-2019:3929
Red Hat JBoss Web Server 5	jws5-tomcat-vault +1	1.1.8-1.Final_redhat_1.1.el6jws	RHSA-2019:3929

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP1	tomcat	9.0.21-4.5.5	SUSE-SU-2019:1895-1
SLES 15	tomcat	9.0.20-3.24.2	SUSE-SU-2019:1825-1, SUSE-SU-2019:1693-1
SLES 12 SP4	tomcat	9.0.21-3.13.2	SUSE-SU-2019:1866-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP4	tomcat	9.0.21-3.13.2	SUSE-SU-2019:1866-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	tomcat	9.0.36-8.4	openSUSE-SU-2024:11468-1
openSUSE Tumbleweed	tomcat10	10.1.14-1.1	openSUSE-SU-2024:13441-1
openSUSE Leap 15.1	tomcat	9.0.21-lp151.3.3.1	openSUSE-SU-2019:1808-1
openSUSE Leap 15.0	tomcat	9.0.20-lp150.2.19.1	openSUSE-SU-2019:1723-1, openSUSE-SU-2019:1673-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat-coyote	>= 9.0.0, < 9.0.16	9.0.16	GHSA-qcxh-w3j9-58qr
Maven	org.apache.tomcat:tomcat-coyote	>= 8.0.0, < 8.5.38	8.5.38	GHSA-qcxh-w3j9-58qr
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 9.0.0, < 9.0.16	9.0.16	GHSA-qcxh-w3j9-58qr
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.0.0, < 8.5.38	8.5.38	GHSA-qcxh-w3j9-58qr

Advisories 12

RHSA-2019:3929 Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release Red Hat Security Advisories (RHSA) · Sep 21, 2026
DSA-4596-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
openSUSE-SU-2019:1673-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2019:1723-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2019:1808-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:1825-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:1693-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:1866-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:1895-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024

References

https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
https://security.netapp.com/advisory/ntap-20190419-0001/
[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199 mailing-list
[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml mailing-list
[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS mailing-list
FEDORA-2019-1a3f878d27 vendor-advisory
https://support.f5.com/csp/article/K17321505
openSUSE-SU-2019:1673 vendor-advisory
FEDORA-2019-d66febb5df vendor-advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
107674 vdb-entry
openSUSE-SU-2019:1723 vendor-advisory
openSUSE-SU-2019:1808 vendor-advisory
RHSA-2019:3929 vendor-advisory
RHSA-2019:3931 vendor-advisory
DSA-4596 vendor-advisory
20191229 [SECURITY] [DSA 4596-1] tomcat8 security update mailing-list
https://www.oracle.com/security-alerts/cpujan2020.html
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
https://www.oracle.com/security-alerts/cpuapr2020.html