Resource exhaustion in Apache Tomcat
CVE-2019-0199
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.729 (99.4th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.705 · newest: 0.729 · change: +0.024
Affected products
- Apache Tomcat — versions 9.0.0
- Apache Tomcat — versions Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0…
- lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745a… (mailing-list)
- lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f… (mailing-list)
- lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa05… (mailing-list)
- lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7… (mailing-list)
- security.netapp.com/advisory/ntap-20190419-0001/ (Third Party Advisory)
- lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e… (mailing-list)
- lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a… (mailing-list)
- lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7e… (mailing-list)
- lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f2… (mailing-list)
Frequently asked questions
- What is CVE-2019-0199?
- CVE-2019-0199 is a high-severity vulnerability in Apache Tomcat, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2019-04-10.
- How severe is CVE-2019-0199?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2019-0199 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.