CVE-2019-0199
Description
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet APIs blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
66.239
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| CVE-2019-10072 and CVE-2019-0199 Fixed in Apache Tomcat 9.0.20 | Windows |
| CVE-2019-10072 and CVE-2019-0199 Fixed in Apache Tomcat 8.5.41 | Windows |
| Vulnerabilities CVE-2019-0199 are fixed in Apache - tomcat-embed-core 9.0.16 | Windows |
| Vulnerabilities CVE-2019-0199 are fixed in Apache - tomcat-embed-core 8.5.38 | Windows |
| tomcat8 security update(DSA-4596-1) tomcat8_8.5.50-0+deb9u1_all.deb | Linux |
| CVE-2019-10072 and CVE-2019-0199 Fixed in Apache Tomcat 9.0.20 (For Linux) | Linux |
| CVE-2019-10072 and CVE-2019-0199 Fixed in Apache Tomcat 8.5.41 (For Linux) | Linux |
| Vulnerabilities CVE-2019-0199 are fixed in Apache - tomcat-embed-core for Linux 9.0.16 | Linux |
| Vulnerabilities CVE-2019-0199 are fixed in Apache - tomcat-embed-core for Linux 8.5.38 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234