Dashboard / CVE-2019-10072

CVE-2019-10072

HIGH
ACT NOW Priority: 5.47 BB Relevance: 85/100
Published: 2019-06-21 Modified: 2026-11-02 First seen: 2026-11-02 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: None
A: High

Description

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Weakness Classification (1)

Affected Software (29)

VendorProductVersion
apache tomcat 8.5.0 – 8.5.40
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
apache tomcat 9.0.0
n/a Apache Tomcat Apache Tomcat 9.0.0.M1 to 9.0.19, 8.5.0 to 8.5.40

References & Advisories (20)

https://usn.ubuntu.com/4128-1/
vendor-advisory x_refsource_UBUNTU
https://usn.ubuntu.com/4128-2/
vendor-advisory x_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2019:3929
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3931
vendor-advisory x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4680
vendor-advisory x_refsource_DEBIAN
http://www.securityfocus.com/bid/108874
vdb-entry x_refsource_BID

Bug Bounty Relevance

85 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ High exploitation probability

CVSS Score

7.5 / 10.0 v3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

72.99%
Raw Score 0.729880
Percentile 99.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.72988
2026-11-12
0.72988
2026-11-10
0.72988
2026-11-09
0.72988
2026-11-08
0.72988
2026-11-07
0.72988
2026-11-06
0.72988
2026-11-05
0.72988
2026-11-04
0.72988
2026-11-03
0.72988
2026-11-02
0.72988

Intelligence Sources

mitre ref →
nvd ref →

External Links