Vulnerability record · CVE-2019-10072 · published 21 June 2019
CVE-2019-10072: Apache Tomcat HTTP/2 connection window exhaustion denial of service
Apache · Tomcat
The fix for CVE-2019-0199 was incomplete and left HTTP/2 connection window exhaustion on write unaddressed in Apache Tomcat 9.0.0.M1 through 9.0.19 and 8.5.0 through 8.5.40. Clients that never send WINDOW_UPDATE messages for the connection window (stream 0) cause server-side threads to block, leading to thread exhaustion and denial of service. The flaw matters because it lets an unauthenticated remote client take down a Tomcat HTTP/2 endpoint with little effort.
Description
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityHigh CVSS (7.5) network-reachable denial of service with very high EPSS, though no KEV listing or confirmed public exploit in this record.
What it is
The fix for CVE-2019-0199 was incomplete and left HTTP/2 connection window exhaustion on write unaddressed in Apache Tomcat 9.0.0.M1 through 9.0.19 and 8.5.0 through 8.5.40. Clients that never send WINDOW_UPDATE messages for the connection window (stream 0) cause server-side threads to block, leading to thread exhaustion and denial of service. The flaw matters because it lets an unauthenticated remote client take down a Tomcat HTTP/2 endpoint with little effort.
Impact
An attacker can exhaust the server's request-processing threads, making the HTTP/2 listener unresponsive to legitimate traffic. The result is a denial of service; there is no confidentiality or integrity impact per the CVSS vector.
Attack surface
Reachable over the network via HTTP/2 on a Tomcat connector, with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Only deployments with HTTP/2 enabled are exposed.
Exploitation
CVE-2019-10072 is not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at roughly 0.73 probability (99.4th percentile), indicating elevated likelihood of attempted exploitation. Reference tags are empty, so no public exploit or PoC is confirmed by this record.
What to do
- Upgrade Apache Tomcat to a release after 9.0.19 or 8.5.40 that contains the complete fix for CVE-2019-0199 and CVE-2019-10072.
- If immediate upgrade is not possible, disable the HTTP/2 connector or restrict HTTP/2 exposure to trusted networks.
- Apply vendor errata for downstream packages (Red Hat, Ubuntu, Debian, SUSE, Oracle, NetApp, F5, Synology) that bundle affected Tomcat versions.
- Monitor and cap concurrent HTTP/2 connections and thread pool usage to limit the effect of window-exhaustion behavior.
Detection
- Alert on sustained HTTP/2 connections that never send WINDOW_UPDATE frames for stream 0, especially from a single source.
- Monitor Tomcat thread pool saturation and request-processing queue growth correlated with HTTP/2 traffic.
- Track spikes in HTTP/2 connection counts or long-lived idle HTTP/2 sessions per client IP.
- Review Tomcat and reverse-proxy logs for HTTP/2 handler errors or timeouts preceding service unavailability.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-10072 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-10072), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
