CVE-2019-0199
tomcat: Apache Tomcat HTTP/2 DoS
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · March 25, 2019
Updated · August 5, 2026
Description
A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.
Statement
pki-servlet-container does not use HTTP/2 in its default configuration.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 · Uncontrolled Resource Consumption