CVE-2019-10072
HighImproper Locking in Apache Tomcat
Published Jun 26, 2019 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2019-10072, DSA-4680-1, GHSA-q4hg-rmq2-52q9, SUSE-SU-2020:0029-1, SUSE-SU-2020:0226-1, SUSE-SU-2020:0632-1, UBUNTU-CVE-2019-10072
Key Facts
Patch immediately- CVE-2019-10072 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Tomcat (Apache), tomcat9 (debian), tomcat8 (ubuntu) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 73% probability of exploitation in the next 30 days.
- Fixed versions are available, including Apache Tomcat <=8.5.40, Apache Tomcat 8.5.40-2.ph1, Apache Tomcat 8.5.40-2.ph2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
73%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-10072 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Affected Products
160 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13, 9.0.0-milestone14, 9.0.0-milestone15, 9.0.0-milestone16 | 8.5.40 |
| tomcat9debian | See advisory | 9.0.22-1 |
| tomcat8ubuntu | See advisory | 8.0.32-1ubuntu1.10 |
| org.apache.tomcat.embed:tomcat-embed-coremaven | >= 9.0.0.M1 | 8.5.41 |
| Apache Tomcatphoton | >= Apache Tomcat 9.0.0.M1 to 9.0.19, 8.5.0 to 8.5.40 | 8.5.40-2.ph1 |
Patched Releases
Apache Tomcat
<=8.5.40, 8.5.40-2.ph1, 8.5.40-2.ph2, 8.5.40-2.ph3, NA
apache-tomcat-webapps
NA
jws5-ecj
0:4.12.0-1.redhat_1.1.el6jws, 0:4.12.0-1.redhat_1.1.el7jws, 0:4.12.0-1.redhat_1.1.el8jws
jws5-javapackages-tools
0:3.4.1-5.15.11.el6jws, 0:3.4.1-5.15.11.el7jws, 0:3.4.1-5.15.11.el8jws
jws5-jboss-logging
0:3.3.2-1.Final_redhat_00001.1.el6jws, 0:3.3.2-1.Final_redhat_00001.1.el7jws, 0:3.3.2-1.Final_redhat_00001.1.el8jws
jws5-mod_cluster
0:1.4.1-1.Final_redhat_00001.2.el6jws, 0:1.4.1-1.Final_redhat_00001.2.el7jws, 0:1.4.1-1.Final_redhat_00001.2.el8jws
jws5-tomcat
0:9.0.21-10.redhat_4.1.el6jws, 0:9.0.21-10.redhat_4.1.el7jws, 0:9.0.21-10.redhat_4.1.el8jws
jws5-tomcat-native
0:1.2.21-34.redhat_34.el6jws, 0:1.2.21-34.redhat_34.el7jws, 0:1.2.21-34.redhat_34.el8jws
jws5-tomcat-vault
0:1.1.8-1.Final_redhat_1.1.el6jws, 0:1.1.8-1.Final_redhat_1.1.el7jws, 0:1.1.8-1.Final_redhat_1.1.el8jws
org.apache.tomcat.embed:tomcat-embed-core
8.5.41, 9.0.20
Tomcat
9.0.21-3.13.2, 9.0.30-3.34.1, 9.0.30-4.10.1, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat-admin-webapps
9.0.21-3.13.2, 9.0.30-3.34.1, 9.0.30-4.10.1, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat-docs-webapp
9.0.21-3.13.2, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat-el-3_0-api
9.0.21-3.13.2, 9.0.30-3.34.1, 9.0.30-4.10.1, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat-embed
9.0.30-lp151.3.6.1, 9.0.36-8.4
tomcat-javadoc
9.0.21-3.13.2, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat-jsp-2_3-api
9.0.21-3.13.2, 9.0.30-3.34.1, 9.0.30-4.10.1, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat-jsvc
9.0.30-lp151.3.6.1, 9.0.36-8.4
tomcat-lib
9.0.21-3.13.2, 9.0.30-3.34.1, 9.0.30-4.10.1, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat-servlet-4_0-api
9.0.21-3.13.2, 9.0.30-3.34.1, 9.0.30-4.10.1, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat-webapps
9.0.21-3.13.2, 9.0.30-3.34.1, 9.0.30-4.10.1, 9.0.30-lp151.3.6.1, 9.0.31-3.25.1, 9.0.36-8.4
tomcat10
10.1.14-1.1
tomcat10-admin-webapps
10.1.14-1.1
tomcat10-doc
10.1.14-1.1
tomcat10-docs-webapp
10.1.14-1.1
Timeline
Publicly disclosed
Jun 26, 2019
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-667 Improper Locking
References
- advisoryhttps://bugzilla.suse.com/1131055
- advisoryhttps://bugzilla.suse.com/1136085
- advisoryhttps://bugzilla.suse.com/1139924
- advisoryhttps://bugzilla.suse.com/1159723
- advisoryhttps://bugzilla.suse.com/1159729
FAQ
Common Questions.
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 .
Affected: Tomcat (Apache) versions 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13, 9.0.0-milestone14, 9.0.0-milestone15, 9.0.0-milestone16; tomcat9 (debian); tomcat8 (ubuntu), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Apache Tomcat <=8.5.40, Apache Tomcat 8.5.40-2.ph1, Apache Tomcat 8.5.40-2.ph2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-10072 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo