CVE-2019-10072 EPSS 73.0%

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache…

Summary

The flaw is an incomplete fix for an earlier HTTP/2 issue in Apache Tomcat, where the server fails to send WINDOW_UPDATE messages for the connection-level window (stream 0) during writes, so server-side threads can block and become exhausted. An attacker who can open HTTP/2 connections to an affected Tomcat instance can cause this exhaustion to produce a denial of service, with no authentication or user interaction described as required.

Official description · CVE.org

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Breakdown

19.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 21 Jun 2019. No public exploit code or confirmed exploitation is recorded.

See the family tree

A fix was bypassed or incomplete once over 2 years. The latest fix listed for tomcat-embed-core is 9.0.31.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2017-5650In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the…17 Apr 2017
same family
CVE-2019-0199The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14…10 Apr 2019
incomplete fixHigh
Why these are linked:
- Stated in the CVE textThe fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 .
This CVECVE-2019-10072The fix for CVE-⁠2019-⁠0199 was incomplete and did not address…21 Jun 2019

Fixes in tomcat-embed-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

9.0.16CVE-2019-019910 Apr 2019
9.0.17CVE-2019-023215 Apr 2019
9.0.17CVE-2019-022128 May 2019
9.0.20CVE-2019-1007221 Jun 2019
9.0.29CVE-2019-1241823 Dec 2019
9.0.30CVE-2019-1756323 Dec 2019
9.0.31CVE-2019-1756924 Feb 2020Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat.embed:tomcat-embed-core.

Mavenorg.apache.tomcat.embed:tomcat-embed-coreGHSA-q4hg-rmq2-52q9

Upgrade to 9.0.109 or later

Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2017-12617, CVE-2018-11784, +10).

Set the version to 9.0.109 or later in your pom.xml or build.gradle.

First fixed in 9.0.20 for CVE-2019-10072.

Affected versions, by release line

If you run	Upgrade to
9.0.0.M1 up to 9.0.20	9.0.109first fix for this CVE: 9.0.20
8.5.0 up to 8.5.41 Still affected on this line by CVE-2025-24813 (no fix published); CVE-2025-31650 (no fix published); CVE-2025-55752 (no fix published).	8.5.94first fix for this CVE: 8.5.41

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

20 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2019-0558

No public exploit code found.

, 30 Oct 2026

73.0%Top 0.55%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.45%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9945 19.9/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total19.9

Record

Published: 21 Jun 2019
Modified: 4 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in tomcat-embed-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

vdb-entry 1

vendor-advisory 6

mailing-list 4

x_refsource_MISC 6

x_refsource_CONFIRM 3

techniques