Skip to content
Sign in Sign up
JA EN FR
SecPulse
Unrated

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19...

CVE-2019-10072 First seen on SecPulse

Fix status by distribution

Fixed packages published by each distribution for this CVE

Original description The description as published by the source.

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details