Thread Exhaustion Vulnerability in Apache Tomcat 9.0 and 8.5
Summary
CVE-2019-0199: The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request... Affects tomcat9 across 24 version ranges.
< 3bd48aab236e5bf0ed1644e9f0c588fd20e503ab
>= 3c78e95e36268dfb76db1570f0cf49104fa6eabc, <= 90583be4f77c92d8e8ac4a48e63b3cdc31e45890
< 7dc5e29fe49850102261badf158752d6865311e4
< 8c48678b110f3fbbe66f6dde0e45d2578fa92c29
< 9.0.16-1
< 9c5edb840d9413c1408e7c191bc0e1bbfcd9e07f
< 10e04de1946981261a734507f4a6d953e2a206fe
< 18b014d8691909be6153ae7db022a6c35f9c93ea
< 29b07def810d335012e738b22ab44d4e232b50d1
< 45f8fd74cdb96490fab8709263a4d862f0d429cf
< 59e713216cf2256aacc54f6ba627865f356f9e4e
< 65ddc3a3872ea41ca67fec7b6834c704b6893361
< 600dc8ba5d9be7599d29bff83c342213d93b034e
< aac670afe1226e10513021100fce8a12344743c6
< aba238718ac9b149d25feaa9a14ecad3b0e3a5e2
< b5a74e3c7913c560648f0ffedfbbb3ebe4318def
< c2c8107f0cea4755497a85990807b883b66f6b57
< c7b84102600d600bcc527560d9c4d10c3fd440ab
< d1dc05e934e089ea8907998cf850760017a0ed82
< d8ebf61e51b4455e3c226751e492a533f9002d48
< de128d72af746184e035ff1b53629f08cb141a04
>= e37b977db6f47e4380ad67114a49e8568951c953, <= 917125ae55a807a90a96d97ecbec5ed13620bc18
< fd7f13635e6855f6ba3fead0bf37ba2fbf8b68cf
< fe854ab1f111396458d98fa2ab08c693ce9407e1
Fixed in 9.0.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The vulnerability in question affects versions 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37, allowing clients to exploit the HTTP/2 implementation, leading to potential denial of service (DoS) conditions.
Vulnerability Detail
The vulnerability arises from the HTTP/2 implementation in Apache Tomcat, which accepted excessive numbers of SETTINGS frames and allowed clients to keep streams open without processing request/response data. This behavior can lead to server-side threads being blocked, ultimately causing thread exhaustion and resulting in a denial of service. The issue is particularly critical for applications utilizing the Servlet API's blocking I/O, as it can severely impact server performance and availability.
How To Fix
Minimum fixed version
9.0.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent HTTP/2 streams or disable HTTP/2 support in your Tomcat configuration until the upgrade is performed. This can be done by modifying the server.xml file and setting the appropriate connector attributes.
Conclusion
The vulnerability CVE-2019-0199 poses a significant risk to Apache Tomcat users, particularly those utilizing blocking I/O. It is crucial to upgrade to the fixed version to mitigate the risk of denial of service. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for tomcat9 →
FAQ
CVE-2019-0199 is a vulnerability in Apache Tomcat that allows clients to keep streams open, leading to thread exhaustion and potential denial of service.
The affected versions include Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground without any signup.
If an immediate upgrade is not possible, consider implementing a temporary workaround by limiting concurrent HTTP/2 streams or disabling HTTP/2 support in your Tomcat configuration.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
