High
Security advisory
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-0199
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:46 UTC · Revision 1
Source evidence
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
osv:CVE-2019-0199
Complete source record
{
"id": "f0778ab2a2d78365e236f799df4bd97fe404a8c6a344936ece8a261b25dcecfc",
"url": "https://osv.dev/vulnerability/CVE-2019-0199",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-0199",
"summary": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"evidence": "osv:CVE-2019-0199",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-0199",
"aliases": [
"CVE-2019-0199",
"GHSA-qcxh-w3j9-58qr"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/tomcat",
"type": "GIT",
"events": [
{
"introduced": "e37b977db6f47e4380ad67114a49e8568951c953"
},
{
"last_affected": "917125ae55a807a90a96d97ecbec5ed13620bc18"
},
{
"introduced": "3c78e95e36268dfb76db1570f0cf49104fa6eabc"
},
{
"last_affected": "90583be4f77c92d8e8ac4a48e63b3cdc31e45890"
},
{
"introduced": "29b07def810d335012e738b22ab44d4e232b50d1"
},
{
"last_affected": "45f8fd74cdb96490fab8709263a4d862f0d429cf"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.37"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.1"
},
{
"last_affected": "9.0.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone1"
},
{
"last_affected": "9.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone10"
},
{
"last_affected": "9.0.0-milestone10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone11"
},
{
"last_affected": "9.0.0-milestone11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone12"
},
{
"last_affected": "9.0.0-milestone12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone13"
},
{
"last_affected": "9.0.0-milestone13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone14"
},
{
"last_affected": "9.0.0-milestone14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone15"
},
{
"last_affected": "9.0.0-milestone15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone16"
},
{
"last_affected": "9.0.0-milestone16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone17"
},
{
"last_affected": "9.0.0-milestone17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone18"
},
{
"last_affected": "9.0.0-milestone18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone19"
},
{
"last_affected": "9.0.0-milestone19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone2"
},
{
"last_affected": "9.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone20"
},
{
"last_affected": "9.0.0-milestone20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone21"
},
{
"last_affected": "9.0.0-milestone21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone3"
},
{
"last_affected": "9.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone4"
},
{
"last_affected": "9.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone5"
},
{
"last_affected": "9.0.0-milestone5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone6"
},
{
"last_affected": "9.0.0-milestone6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone7"
},
{
"last_affected": "9.0.0-milestone7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone8"
},
{
"last_affected": "9.0.0-milestone8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone9"
},
{
"last_affected": "9.0.0-milestone9"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"9.0.0-milestone1",
"9.0.0-milestone10",
"9.0.0-milestone11",
"9.0.0-milestone12",
"9.0.0-milestone13",
"9.0.0-milestone14",
"9.0.0-milestone15",
"9.0.0-milestone16",
"9.0.0-milestone17",
"9.0.0-milestone18",
"9.0.0-milestone19",
"9.0.0-milestone2",
"9.0.0-milestone20",
"9.0.0-milestone21",
"9.0.0-milestone3",
"9.0.0-milestone4",
"9.0.0-milestone5",
"9.0.0-milestone6",
"9.0.0-milestone7",
"9.0.0-milestone8",
"9.0.0-milestone9"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-0199.json"
}
}
],
"modified": "2026-10-24T10:30:33.166089383Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E",
"https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E",
"https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/",
"https://seclists.org/bugtraq/2019/Dec/43",
"https://support.f5.com/csp/article/K17321505",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://access.redhat.com/errata/RHSA-2019:3929",
"https://access.redhat.com/errata/RHSA-2019:3931",
"https://security.netapp.com/advisory/ntap-20190419-0001/",
"https://www.debian.org/security/2019/dsa-4596",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-0199",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 433193,
"published_at": "2019-04-10T15:29:00.39+00:00"
}