CVE-2019-0199

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 9.0.0.M1 through 9.0.14 Apache Tomcat versions 8.5.0 through 8.5.37

Description: The issue is related to the HTTP/2 implementation, which accepted streams with excessive numbers of SETTINGS frames and permitted clients to keep streams open without reading/writing request/response data. This allowed clients to cause server-side threads to block, leading to thread exhaustion and a denial of service (DoS). The problem is associated with uncontrolled resource consumption.

Recommendations: For Apache Tomcat versions 9.0.0.M1 through 9.0.14, update to a version that includes a fix for the HTTP/2 implementation issue to prevent thread exhaustion. For Apache Tomcat versions 8.5.0 through 8.5.37, update to a version that includes a fix for the HTTP/2 implementation issue to prevent thread exhaustion. As a temporary workaround, consider restricting the number of SETTINGS frames and implementing measures to prevent clients from keeping streams open indefinitely to minimize the risk of exploitation.