CVE-2019-0199
Apache Tomcat Denial of Service vulnerability
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Record
CVE-2019-0199- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Record
CVE-2019-0199- Updated
- 2026-11-02
EUVDEUVD-2020-0508 No score
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Record
EUVD-2020-0508- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qcxh-w3j9-58qr
Apache Tomcat Denial of Service vulnerability
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Record
GHSA-qcxh-w3j9-58qr- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Record
CVE-2019-0199- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-0199
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Record
DEBIAN-CVE-2019-0199- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSVGHSA-qcxh-w3j9-58qr
Apache Tomcat Denial of Service vulnerability
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Record
GHSA-qcxh-w3j9-58qr- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVRHSA-2019:3929
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
- Record
RHSA-2019:3929- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-0199
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Record
UBUNTU-CVE-2019-0199- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0260 No score
Updated tomcat packages fix security vulnerabilities
Updated tomcat packages fix security vulnerabilities:
The HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS (CVE-2019-0199).
The SSI printenv command echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website (CVE-2019-0221).
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write. By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS (CVE-2019-10072).
The tomcat package has been updated to version 9.0.21 to fix these issues. The tomcat-native package has also been updated to version 1.2.23.
- Record
MGASA-2019-0260- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1673-1 No score
Security update for tomcat
This update for tomcat to version 9.0.20 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
Non-security issues fixed:
- Increase maximum number of threads and open files for tomcat (bsc#1111966).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1673-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1723-1 No score
Security update for tomcat
This update for tomcat to version 9.0.21 fixes the following issues:
Security issue fixed:
- CVE-2019-0199: Added additional fixes to address HTTP/2 connection window exhaustion (bsc#1139924).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1723-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1808-1 No score
Security update for tomcat
This update for tomcat to version 9.0.21 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
Non-security issues fixed:
- Increase maximum number of threads and open files for tomcat (bsc#1111966).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2019:1808-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11468-1 No score
tomcat-9.0.36-8.4 on GA media
These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11468-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13441-1 No score
tomcat10-10.1.14-1.1 on GA media
These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13441-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1693-1 No score
Security update for tomcat
This update for tomcat to version 9.0.20 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
Non-security issues fixed:
- Increase maximum number of threads and open files for tomcat (bsc#1111966).
- Record
SUSE-SU-2019:1693-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1825-1 No score
Security update for tomcat
This update for tomcat to version 9.0.21 fixes the following issues:
Security issue fixed:
- CVE-2019-0199: Added additional fixes to address HTTP/2 connection window exhaustion (bsc#1139924).
- Record
SUSE-SU-2019:1825-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1866-1 No score
Security update for tomcat
This update for tomcat to version 9.0.21 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
- CVE-2019-10072: Fixed incomplete patch for CVE-2019-0199 (bsc#1139924).
Please also see http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.21_(markt) and http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.20_(markt)
- Record
SUSE-SU-2019:1866-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1895-1 No score
Security update for tomcat
This update for tomcat to version 9.0.21 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
Non-security issues fixed:
- Increase maximum number of threads and open files for tomcat (bsc#1111966).
- Record
SUSE-SU-2019:1895-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-coreMaven |
9.0.0 up to 9.0.16 | 9.0.16 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
8.0.0 up to 8.5.38 | 8.5.38 |
org.apache.tomcat:tomcat-coyoteMaven |
9.0.0 up to 9.0.16 | 9.0.16 |
org.apache.tomcat:tomcat-coyoteMaven |
8.0.0 up to 8.5.38 | 8.5.38 |
tomcat9Debian:12 |
before 9.0.16-1 | 9.0.16-1 |
tomcat9Debian:13 |
before 9.0.16-1 | 9.0.16-1 |
tomcat9Debian:14 |
before 9.0.16-1 | 9.0.16-1 |
tomcat8Debian:9 From an advisory covering 6 CVEs |
before 8.5.50-0+deb9u1, plus listed versions 8.5.14-18.5.14-1+deb9u18.5.14-1+deb9u28.5.14-1+deb9u38.5.14-2 Show 31 moreShow less8.5.15-18.5.16-18.5.21-18.5.23-18.5.24-18.5.24-28.5.24-2~bpo9+18.5.28-18.5.28-1~bpo9+18.5.29-18.5.29-1~bpo9+18.5.30-18.5.31-18.5.32-18.5.32-28.5.33-18.5.33-1~bpo9+18.5.34-18.5.34-1~bpo9+18.5.35-18.5.35-28.5.35-2~bpo9+18.5.35-38.5.37-18.5.37-1~bpo9+18.5.37-28.5.38-18.5.38-1~bpo9+18.5.38-28.5.38-2~bpo9+18.5.39-1 |
8.5.50-0+deb9u1 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
9.0.0 up to 9.0.16, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 7 moreShow less9.0.149.0.29.0.49.0.59.0.69.0.79.0.8 |
9.0.16 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
8.0.0 up to 8.5.38, plus listed versions 8.0.18.0.118.0.128.0.148.0.15 Show 45 moreShow less8.0.178.0.188.0.208.0.218.0.228.0.238.0.248.0.268.0.278.0.288.0.298.0.38.0.308.0.328.0.338.0.358.0.368.0.378.0.388.0.398.0.418.0.428.0.438.0.448.0.458.0.468.0.478.0.488.0.498.0.58.0.508.0.518.0.528.0.538.0.88.0.98.5.08.5.118.5.128.5.138.5.148.5.158.5.168.5.198.5.2 |
8.5.38 |
Show 75 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcat-coyoteMaven |
9.0.0 up to 9.0.16, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 7 moreShow less9.0.149.0.29.0.49.0.59.0.69.0.79.0.8 |
9.0.16 |
org.apache.tomcat:tomcat-coyoteMaven |
8.0.0 up to 8.5.38, plus listed versions 8.0.18.0.118.0.128.0.148.0.15 Show 45 moreShow less8.0.178.0.188.0.208.0.218.0.228.0.238.0.248.0.268.0.278.0.288.0.298.0.38.0.308.0.328.0.338.0.358.0.368.0.378.0.388.0.398.0.418.0.428.0.438.0.448.0.458.0.468.0.478.0.488.0.498.0.58.0.508.0.518.0.528.0.538.0.88.0.98.5.08.5.118.5.128.5.138.5.148.5.158.5.168.5.198.5.2 |
8.5.38 |
tomcatMageia:7 From an advisory covering 3 CVEs |
before 9.0.21-1.mga7 | 9.0.21-1.mga7 |
tomcat-nativeMageia:7 From an advisory covering 3 CVEs |
before 1.2.23-1.mga7 | 1.2.23-1.mga7 |
jws5-ecjRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:4.12.0-1.redhat_1.1.el6jws | 0:4.12.0-1.redhat_1.1.el6jws |
jws5-javapackages-toolsRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:3.4.1-5.15.11.el6jws | 0:3.4.1-5.15.11.el6jws |
jws5-jboss-loggingRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:3.3.2-1.Final_redhat_00001.1.el6jws | 0:3.3.2-1.Final_redhat_00001.1.el6jws |
jws5-mod_clusterRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:1.4.1-1.Final_redhat_00001.2.el6jws | 0:1.4.1-1.Final_redhat_00001.2.el6jws |
jws5-mod_cluster-tomcatRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:1.4.1-1.Final_redhat_00001.2.el6jws | 0:1.4.1-1.Final_redhat_00001.2.el6jws |
jws5-python-javapackagesRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:3.4.1-5.15.11.el6jws | 0:3.4.1-5.15.11.el6jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:1.2.21-34.redhat_34.el6jws | 0:1.2.21-34.redhat_34.el6jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:1.2.21-34.redhat_34.el6jws | 0:1.2.21-34.redhat_34.el6jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-tomcat-vaultRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:1.1.8-1.Final_redhat_1.1.el6jws | 0:1.1.8-1.Final_redhat_1.1.el6jws |
jws5-tomcat-vault-javadocRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:1.1.8-1.Final_redhat_1.1.el6jws | 0:1.1.8-1.Final_redhat_1.1.el6jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.2::el6 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el6jws | 0:9.0.21-10.redhat_4.1.el6jws |
jws5-ecjRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:4.12.0-1.redhat_1.1.el7jws | 0:4.12.0-1.redhat_1.1.el7jws |
jws5-javapackages-toolsRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:3.4.1-5.15.11.el7jws | 0:3.4.1-5.15.11.el7jws |
jws5-jboss-loggingRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:3.3.2-1.Final_redhat_00001.1.el7jws | 0:3.3.2-1.Final_redhat_00001.1.el7jws |
jws5-mod_clusterRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:1.4.1-1.Final_redhat_00001.2.el7jws | 0:1.4.1-1.Final_redhat_00001.2.el7jws |
jws5-mod_cluster-tomcatRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:1.4.1-1.Final_redhat_00001.2.el7jws | 0:1.4.1-1.Final_redhat_00001.2.el7jws |
jws5-python-javapackagesRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:3.4.1-5.15.11.el7jws | 0:3.4.1-5.15.11.el7jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:1.2.21-34.redhat_34.el7jws | 0:1.2.21-34.redhat_34.el7jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:1.2.21-34.redhat_34.el7jws | 0:1.2.21-34.redhat_34.el7jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-tomcat-vaultRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:1.1.8-1.Final_redhat_1.1.el7jws | 0:1.1.8-1.Final_redhat_1.1.el7jws |
jws5-tomcat-vault-javadocRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:1.1.8-1.Final_redhat_1.1.el7jws | 0:1.1.8-1.Final_redhat_1.1.el7jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.2::el7 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el7jws | 0:9.0.21-10.redhat_4.1.el7jws |
jws5-ecjRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:4.12.0-1.redhat_1.1.el8jws | 0:4.12.0-1.redhat_1.1.el8jws |
jws5-javapackages-toolsRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:3.4.1-5.15.11.el8jws | 0:3.4.1-5.15.11.el8jws |
jws5-jboss-loggingRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:3.3.2-1.Final_redhat_00001.1.el8jws | 0:3.3.2-1.Final_redhat_00001.1.el8jws |
jws5-mod_clusterRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:1.4.1-1.Final_redhat_00001.2.el8jws | 0:1.4.1-1.Final_redhat_00001.2.el8jws |
jws5-mod_cluster-tomcatRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:1.4.1-1.Final_redhat_00001.2.el8jws | 0:1.4.1-1.Final_redhat_00001.2.el8jws |
jws5-python-javapackagesRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:3.4.1-5.15.11.el8jws | 0:3.4.1-5.15.11.el8jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:1.2.21-34.redhat_34.el8jws | 0:1.2.21-34.redhat_34.el8jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:1.2.21-34.redhat_34.el8jws | 0:1.2.21-34.redhat_34.el8jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
jws5-tomcat-vaultRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:1.1.8-1.Final_redhat_1.1.el8jws | 0:1.1.8-1.Final_redhat_1.1.el8jws |
jws5-tomcat-vault-javadocRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:1.1.8-1.Final_redhat_1.1.el8jws | 0:1.1.8-1.Final_redhat_1.1.el8jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.2::el8 From an advisory covering 6 CVEs |
before 0:9.0.21-10.redhat_4.1.el8jws | 0:9.0.21-10.redhat_4.1.el8jws |
tomcatSUSE:Linux Enterprise Module for Web and Scripting 15 From an advisory covering 2 CVEs |
before 9.0.20-3.24.2 | 9.0.20-3.24.2 |
tomcatSUSE:Linux Enterprise Module for Web and Scripting 15 |
before 9.0.21-3.27.1 | 9.0.21-3.27.1 |
tomcatSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 3 CVEs |
before 9.0.21-3.13.2 | 9.0.21-3.13.2 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 3 CVEs |
before 9.0.21-3.13.2 | 9.0.21-3.13.2 |
tomcatSUSE:Linux Enterprise Module for Web and Scripting 15 SP1 From an advisory covering 2 CVEs |
before 9.0.21-4.5.5 | 9.0.21-4.5.5 |
tomcat8Ubuntu:18.04:LTS |
before 8.5.39-1ubuntu1~18.04.1, plus listed versions 8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.28.5.30-1ubuntu1.38.5.30-1ubuntu1.4 |
8.5.39-1ubuntu1~18.04.1 |
tomcatopenSUSE:Leap 15.0 From an advisory covering 2 CVEs |
before 9.0.20-lp150.2.19.1 | 9.0.20-lp150.2.19.1 |
tomcatopenSUSE:Leap 15.0 |
before 9.0.21-lp150.2.22.1 | 9.0.21-lp150.2.22.1 |
tomcatopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 9.0.21-lp151.3.3.1 | 9.0.21-lp151.3.3.1 |
tomcatopenSUSE:Tumbleweed From an advisory covering 25 CVEs |
before 9.0.36-8.4 | 9.0.36-8.4 |
tomcat10openSUSE:Tumbleweed From an advisory covering 49 CVEs |
before 10.1.14-1.1 | 10.1.14-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-0199 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published April 10, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 72.9%, the 99th percentile. Fixed in org.apache.tomcat.embed:tomcat-embed-core 9.0.16.
References
lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E
security.netapp.com/advisory/ntap-20190419-0001
Show 152 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46
support.f5.com/csp/article/K17321505
lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html
oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
securityfocus.com/bid/107674
access.redhat.com/errata/RHSA-2019:3929
debian.org/security/2019/dsa-4596
seclists.org/bugtraq/2019/Dec/43
nvd.nist.gov/vuln/detail/CVE-2019-0199
web.archive.org/web/20200227030041/http://www.securityfocus.com/bid/107674
github.com/advisories/GHSA-qcxh-w3j9-58qr
security-tracker.debian.org/tracker/CVE-2019-0199
advisories.mageia.org/MGASA-2019-0260.html
bugs.mageia.org/show_bug.cgi?id=24799
tomcat.apache.org/security-9.html
bugzilla.redhat.com/show_bug.cgi?id=1645695
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3929.json
cve.org/CVERecord?id=CVE-2018-5407
openssl.org/news/secadv/20181112.txt
suse.com/support/update/announcement/2019/suse-su-20191693-1
bugzilla.suse.com/1111966
ubuntu.com/security/CVE-2019-0199
Left out here: 40 versions. The JSON record has them.