{"id":"CVE-2019-10072","aliases":["CLSA-2025-1748282295","DEBIAN-CVE-2019-10072","DSA-4680-1","EUVD-2019-0558","GHSA-q4hg-rmq2-52q9","MGASA-2019-0260","RHSA-2019:3929","SUSE-SU-2019:1866-1","SUSE-SU-2020:0029-1","SUSE-SU-2020:0226-1","SUSE-SU-2020:0632-1","UBUNTU-CVE-2019-10072","USN-4128-1","USN-4128-2","openSUSE-SU-2020:0038-1","openSUSE-SU-2024:11468-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Improper Locking in Apache Tomcat","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.72988,"percentile":0.99458,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-667"],"published":"2019-06-21T00:00:00Z","modified":"2026-11-04T02:30:41Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.20","8.5.41"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.22-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"tomcat8","fixed_in":["8.5.39-1ubuntu1~18.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.20"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.41"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u1"}]}],"versions":["9.0.16-4","9.0.16-5","9.0.22-1","9.0.24-1","9.0.27-1","9.0.31-1~bpo10+1"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.20"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.41"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.5","8.5.6","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Mageia:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.21-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.23-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-ecj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1.redhat_1.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-5.15.11.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-1.Final_redhat_00001.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.Final_redhat_00001.2.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-mod_cluster-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.Final_redhat_00001.2.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-python-javapackages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-5.15.11.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.21-34.redhat_34.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.21-34.redhat_34.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-1.Final_redhat_1.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-vault-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-1.Final_redhat_1.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el6","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el6jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-ecj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1.redhat_1.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-5.15.11.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-1.Final_redhat_00001.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.Final_redhat_00001.2.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-mod_cluster-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.Final_redhat_00001.2.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-python-javapackages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-5.15.11.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.21-34.redhat_34.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.21-34.redhat_34.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-1.Final_redhat_1.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-vault-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-1.Final_redhat_1.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-ecj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1.redhat_1.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-5.15.11.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-1.Final_redhat_00001.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.Final_redhat_00001.2.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-mod_cluster-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.Final_redhat_00001.2.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-python-javapackages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-5.15.11.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.21-34.redhat_34.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.21-34.redhat_34.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-1.Final_redhat_1.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-vault-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.8-1.Final_redhat_1.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.2::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.21-10.redhat_4.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.21-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.21-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.30-4.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.30-3.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-3.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-3.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-3.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-3.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.1"}]}],"versions":["9.0.16-3~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.10"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.1"}]}],"versions":["9.0.16-3~18.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.30-lp151.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-8.4"}]}],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"http://www.securityfocus.com/bid/108874","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4128-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4128-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2020/dsa-4680","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_29","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190625-0002/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://support.f5.com/csp/article/K17321505","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10072","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://web.archive.org/web/20200227033743/http://www.securityfocus.com/bid/108874","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/0bcd69c9dd8ae0ff424f2cd46de51583510b7f35","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/7f748eb6bfaba5207c89dbd7d5adf50fae847145","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/8d14c6f21d29768a39be4b6b9517060dc6606758","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/ada725a50a60867af3422c8e612aecaeea856a9a","tags":["web"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://usn.ubuntu.com/4128-1","tags":["web"]},{"url":"https://usn.ubuntu.com/4128-2","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190625-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q4hg-rmq2-52q9"},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10072","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2019-0260.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24799","tags":["report"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.16","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.19","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20","tags":["web"]},{"url":"https://tomcat.apache.org/native-doc/miscellaneous/changelog.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1645695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723708","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3929.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-5407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5407","tags":["advisory"]},{"url":"https://github.com/bbbrumley/portsmash","tags":["article"]},{"url":"https://www.openssl.org/news/secadv/20181112.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0199","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0199","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0221","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0232","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1701056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0232","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","tags":["advisory"]},{"url":"https://github.com/RUB-NDS/TLS-Padding-Oracles","tags":["article"]},{"url":"https://www.openssl.org/news/secadv/20190226.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10072","tags":["advisory","report"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41","tags":["article","report"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20","tags":["article","report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191866-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1131055","tags":["report"]},{"url":"https://bugzilla.suse.com/1136085","tags":["report"]},{"url":"https://bugzilla.suse.com/1139924","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200029-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159723","tags":["report"]},{"url":"https://bugzilla.suse.com/1159729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200226-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1161025","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200632-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1164692","tags":["report"]},{"url":"https://bugzilla.suse.com/1164825","tags":["report"]},{"url":"https://bugzilla.suse.com/1164860","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-10072","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4128-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4128-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-0221","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/54BLO3OHVPO6A3AIEQHGLVDNHSXP5KDS/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-10072","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","status":"published","published":"2019-06-21T17:56:42Z","modified":"2026-11-02T17:31:07.478Z","updated_at":"2026-11-02T19:02:29.283836Z"}],"euvd":[{"id":"EUVD-2019-0558","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","status":"published","published":"2019-06-21T17:56:42Z","modified":"2026-11-02T17:31:07Z","updated_at":"2026-11-03T05:08:39.764975Z"}],"ghsa":[{"id":"GHSA-q4hg-rmq2-52q9","title":"Improper Locking in Apache Tomcat","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","status":"published","published":"2019-06-26T01:09:40Z","modified":"2024-03-11T15:39:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-667"],"updated_at":"2026-11-02T14:37:40.81935Z"}],"nvd":[{"id":"CVE-2019-10072","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","status":"published","published":"2019-06-21T18:15:09.513Z","modified":"2026-11-02T18:18:22.753Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-667"],"updated_at":"2026-11-02T20:51:29.040079Z"}],"osv":[{"id":"CVE-2019-10072","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","status":"published","published":"2019-06-21T18:15:09.513Z","modified":"2026-11-04T02:30:41.1301948Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"DEBIAN-CVE-2019-10072","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","status":"published","published":"2019-06-21T18:15:09.513Z","modified":"2026-11-03T09:47:29.725307016Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"GHSA-q4hg-rmq2-52q9","title":"Improper Locking in Apache Tomcat","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","status":"published","published":"2019-06-26T01:09:40Z","modified":"2024-03-11T15:55:43.65767Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-667"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"RHSA-2019:3929","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release","status":"published","published":"2024-09-16T02:40:14Z","modified":"2026-09-21T10:02:24Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-10072","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","status":"published","published":"2019-06-21T00:00:00Z","modified":"2026-02-04T02:50:07.941141Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"DSA-4680-1","title":"tomcat9 - security update","status":"published","published":"2020-05-06T00:00:00Z","modified":"2026-03-09T02:11:09.792157Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2019-0260","title":"Updated tomcat packages fix security vulnerabilities","description":"Updated tomcat packages fix security vulnerabilities:\n\nThe HTTP/2 implementation accepted streams with excessive numbers of\nSETTINGS frames and also permitted clients to keep streams open without\nreading/writing request/response data. By keeping streams open for\nrequests that utilised the Servlet API's blocking I/O, clients were able\nto cause server-side threads to block eventually leading to thread\nexhaustion and a DoS (CVE-2019-0199).\n\nThe SSI printenv command echoes user provided data without escaping and\nis, therefore, vulnerable to XSS. SSI is disabled by default. The printenv\ncommand is intended for debugging and is unlikely to be present in a\nproduction website (CVE-2019-0221).\n\nThe fix for CVE-2019-0199 was incomplete and did not address HTTP/2\nconnection window exhaustion on write. By not sending WINDOW_UPDATE\nmessages for the connection window (stream 0) clients were able to cause\nserver-side threads to block eventually leading to thread exhaustion and\na DoS (CVE-2019-10072).\n\nThe tomcat package has been updated to version 9.0.21 to fix these issues.\nThe tomcat-native package has also been updated to version 1.2.23.\n","status":"published","published":"2019-09-08T14:09:05Z","modified":"2026-04-16T04:41:36.317120217Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2020:0038-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.30 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12418: Fixed a local privilege escalation through by manipulating the RMI registry and performing a man-in-the-middle attack (bsc#1159723).\n- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-01-13T15:21:17Z","modified":"2026-02-04T03:18:54.157641Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11468-1","title":"tomcat-9.0.36-8.4 on GA media","description":"These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:40.917277Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2019:1866-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.21 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to \n  streams with excessive numbers of SETTINGS frames (bsc#1131055).\n- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).\n- CVE-2019-10072: Fixed incomplete patch for CVE-2019-0199 (bsc#1139924).\n\nPlease also see\n\thttp://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.21_(markt)\nand\n\thttp://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.20_(markt)\n","status":"published","published":"2019-07-17T11:10:40Z","modified":"2026-02-04T03:01:55.80644Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2020:0029-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.30 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12418: Fixed a local privilege escalation through by manipulating the RMI registry and performing a man-in-the-middle attack (bsc#1159723).\n- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).\n","status":"published","published":"2020-01-07T14:44:20Z","modified":"2026-02-04T03:49:16.751567Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0226-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.30 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12418: Fixed a local privilege escalation by manipulating the RMI registry (bsc#1159723).\n- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).\n\nNon-security issue fixed: \n\n- Fixed a problem during startup, related to changes in Java 9+ APIs (bsc#1161025).\n","status":"published","published":"2020-01-24T08:23:25Z","modified":"2026-02-04T03:35:41.357188Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0632-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.31 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-10072: Fixed a denial-of-service that could have been caused by clients omitting WINDOW_UPDATE messages in HTTP/2 streams (bsc#1139924).\n- CVE-2019-12418: Fixed a local privilege escalation by manipulating the RMI registry (bsc#1159723).\n- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).\n- CVE-2019-17569: Fixed a regression in the handling of Transfer-Encoding headers that would have allowed HTTP Request Smuggling (bsc#1164825).\n- CVE-2020-1935: Fixed an HTTP Request Smuggling issue (bsc#1164860).\n- CVE-2020-1938: Fixed a file contents disclosure vulnerability (bsc#1164692).\n","status":"published","published":"2020-03-10T12:13:09Z","modified":"2026-02-04T04:35:59.725465Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4128-1","title":"tomcat8 vulnerabilities","description":"It was discovered that the Tomcat 8 SSI printenv command echoed user \nprovided data without escaping it. An attacker could possibly use this \nissue to perform an XSS attack. (CVE-2019-0221)\n\nIt was discovered that Tomcat 8 did not address HTTP/2 connection window\nexhaustion on write while addressing CVE-2019-0199. An attacker could \npossibly use this issue to cause a denial of service. (CVE-2019-10072)\n","status":"published","published":"2019-09-10T18:22:28Z","modified":"2026-02-10T04:41:38Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4128-2","title":"tomcat9 vulnerabilities","description":"It was discovered that the Tomcat 9 SSI printenv command echoed user \nprovided data without escaping it. An attacker could possibly use this \nissue to perform an XSS attack. (CVE-2019-0221)\n\nIt was discovered that Tomcat 9 did not address HTTP/2 connection window\nexhaustion on write while addressing CVE-2019-0199. An attacker could \npossibly use this issue to cause a denial of service. (CVE-2019-10072)\n","status":"published","published":"2019-09-18T14:08:33Z","modified":"2026-02-10T04:41:38Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}