Vulnerability record · CVE-2019-0199 · published 10 April 2019
CVE-2019-0199: Apache Tomcat HTTP/2 stream handling allows thread exhaustion DoS
Apache · Tomcat
Apache Tomcat's HTTP/2 implementation accepts streams with excessive SETTINGS frames and lets clients hold streams open without sending or reading request/response data. When those streams use the Servlet API's blocking I/O, server-side threads block until the thread pool is exhausted. This is a remote, unauthenticated denial-of-service condition affecting Tomcat 9.0.0.M1 through 9.0.14 and 8.5.0 through 8.5.37.
Description
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote, unauthenticated, low-complexity availability impact with a very high EPSS score, though no confirmed in-the-wild exploitation is recorded.
What it is
Apache Tomcat's HTTP/2 implementation accepts streams with excessive SETTINGS frames and lets clients hold streams open without sending or reading request/response data. When those streams use the Servlet API's blocking I/O, server-side threads block until the thread pool is exhausted. This is a remote, unauthenticated denial-of-service condition affecting Tomcat 9.0.0.M1 through 9.0.14 and 8.5.0 through 8.5.37.
Impact
An attacker can exhaust Tomcat's request-processing threads, causing the server to stop serving legitimate requests. There is no confidentiality or integrity impact; the effect is availability loss.
Attack surface
Reachable over the network via HTTP/2 to the Tomcat connector, with no authentication and no user interaction required (CVSS vector AV:N/AC:L/PR:N/UI:N). The attacker only needs to open and hold streams that trigger blocking Servlet I/O.
Exploitation
Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is 0.72855 (99.4th percentile), indicating a high modeled likelihood of exploitation activity.
What to do
- Upgrade Apache Tomcat to a release after 9.0.14 or 8.5.37 that contains the HTTP/2 fix.
- If immediate upgrade is not possible, disable the HTTP/2 connector or restrict HTTP/2 exposure to trusted networks.
- Apply vendor errata for packaged Tomcat distributions (for example Red Hat RHSA-2019:3929 and RHSA-2019:3931) or the relevant SUSE updates.
- Tune connector thread pools and HTTP/2 stream limits to reduce the blast radius of stream-holding clients.
- Monitor and rate-limit clients that open many long-lived HTTP/2 streams.
Detection
- Alert on sustained growth in busy Tomcat worker threads or thread pool exhaustion events.
- Monitor for HTTP/2 clients opening many streams that remain open without corresponding request/response data.
- Track abnormal counts of SETTINGS frames per connection in HTTP/2 traffic.
- Correlate Tomcat availability degradation with a small number of source IPs holding long-lived streams.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-0199 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-0199), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
