CVE-2019-0199
HighApache Tomcat Denial of Service vulnerability
Published Jun 15, 2020 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2019-0199, GHSA-qcxh-w3j9-58qr, SUSE-SU-2019:1693-1, SUSE-SU-2019:1825-1, SUSE-SU-2019:1866-1, SUSE-SU-2019:1895-1, UBUNTU-CVE-2019-0199
Key Facts
Patch immediately- CVE-2019-0199 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Tomcat (Apache), tomcat8 (debian), tomcat9 (debian) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 73% probability of exploitation in the next 30 days.
- Fixed versions are available, including Apache Tomcat <=8.5.37, Apache Tomcat 8.5.40-1.ph1, Apache Tomcat 8.5.40-1.ph2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
73%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-0199 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Affected Products
155 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13, 9.0.0-milestone14, 9.0.0-milestone15, 9.0.0-milestone16 | 8.5.37 |
| tomcat8debian | See advisory | 8.5.50-0+deb9u1 |
| tomcat9debian | See advisory | 9.0.16-1 |
| org.apache.tomcat.embed:tomcat-embed-coremaven | >= 9.0.0 | 8.5.38 |
| org.apache.tomcat:tomcat-coyotemaven | >= 9.0.0 | 8.5.38 |
Patched Releases
Apache Tomcat
<=8.5.37, 8.5.40-1.ph1, 8.5.40-1.ph2, 8.5.40-1.ph3, NA
apache-tomcat-webapps
NA
jws5-ecj
0:4.12.0-1.redhat_1.1.el6jws, 0:4.12.0-1.redhat_1.1.el7jws, 0:4.12.0-1.redhat_1.1.el8jws
jws5-javapackages-tools
0:3.4.1-5.15.11.el6jws, 0:3.4.1-5.15.11.el7jws, 0:3.4.1-5.15.11.el8jws
jws5-jboss-logging
0:3.3.2-1.Final_redhat_00001.1.el6jws, 0:3.3.2-1.Final_redhat_00001.1.el7jws, 0:3.3.2-1.Final_redhat_00001.1.el8jws
jws5-mod_cluster
0:1.4.1-1.Final_redhat_00001.2.el6jws, 0:1.4.1-1.Final_redhat_00001.2.el7jws, 0:1.4.1-1.Final_redhat_00001.2.el8jws
jws5-tomcat
0:9.0.21-10.redhat_4.1.el6jws, 0:9.0.21-10.redhat_4.1.el7jws, 0:9.0.21-10.redhat_4.1.el8jws
jws5-tomcat-native
0:1.2.21-34.redhat_34.el6jws, 0:1.2.21-34.redhat_34.el7jws, 0:1.2.21-34.redhat_34.el8jws
jws5-tomcat-vault
0:1.1.8-1.Final_redhat_1.1.el6jws, 0:1.1.8-1.Final_redhat_1.1.el7jws, 0:1.1.8-1.Final_redhat_1.1.el8jws
org.apache.tomcat:tomcat-coyote
8.5.38, 9.0.16
org.apache.tomcat.embed:tomcat-embed-core
8.5.38, 9.0.16
Tomcat
9.0.20-3.24.2, 9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-3.27.1, 9.0.21-4.5.5, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-admin-webapps
9.0.20-3.24.2, 9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-3.27.1, 9.0.21-4.5.5, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-docs-webapp
9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-el-3_0-api
9.0.20-3.24.2, 9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-3.27.1, 9.0.21-4.5.5, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-embed
9.0.20-lp150.2.19.1, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-javadoc
9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-jsp-2_3-api
9.0.20-3.24.2, 9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-3.27.1, 9.0.21-4.5.5, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-jsvc
9.0.20-lp150.2.19.1, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-lib
9.0.20-3.24.2, 9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-3.27.1, 9.0.21-4.5.5, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-servlet-4_0-api
9.0.20-3.24.2, 9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-3.27.1, 9.0.21-4.5.5, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat-webapps
9.0.20-3.24.2, 9.0.20-lp150.2.19.1, 9.0.21-3.13.2, 9.0.21-3.27.1, 9.0.21-4.5.5, 9.0.21-lp150.2.22.1, 9.0.21-lp151.3.3.1, 9.0.36-8.4
tomcat10
10.1.14-1.1
tomcat10-admin-webapps
10.1.14-1.1
tomcat10-doc
10.1.14-1.1
Timeline
Publicly disclosed
Jun 15, 2020
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
References
- advisoryRHSA-2020:2366
- advisoryhttps://bugzilla.suse.com/1111966
- advisoryhttps://bugzilla.suse.com/1131055
- advisoryhttps://bugzilla.suse.com/1136085
- advisoryhttps://bugzilla.suse.com/1139924
FAQ
Common Questions.
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data.
Affected: Tomcat (Apache) versions 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13, 9.0.0-milestone14, 9.0.0-milestone15, 9.0.0-milestone16; tomcat8 (debian); tomcat9 (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Apache Tomcat <=8.5.37, Apache Tomcat 8.5.40-1.ph1, Apache Tomcat 8.5.40-1.ph2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-0199 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo