high 7.5

CVE-2019-10072 in the critical feed json

Improper Locking in Apache Tomcat

published 2019-06-21 7y ago modified 2026-11-02 7d ago also GHSA-q4hg-rmq2-52q9 , EUVD-2019-0558

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 73.0%; EPSS 73.0% chance of exploitation in 30 days, percentile 99.4%
public exploits: 0; none known

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Patch / fix

fixed in 1 distros 5 links 4

maven org.apache.tomcat.embed:tomcat-embed-core 8.5.41, 9.0.20

debian ubuntu red hat suse opensuse

tomcat9 Debian 14, Debian 13, Debian 12 9.0.22-1

debian advisories DEBIAN-CVE-2019-10072

tomcat8 Ubuntu 18.04 LTS 8.5.39-1ubuntu1~18.04.3
tomcat9 Ubuntu 18.04 LTS 9.0.16-3ubuntu0.18.04.1

ubuntu advisories UBUNTU-CVE-2019-10072

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

jws5-ecj jboss enterprise web server 5.2 4.12.0-1.redhat_1.1.el6jws
jws5-ecj jboss enterprise web server 5.2 4.12.0-1.redhat_1.1.el7jws
jws5-ecj jboss enterprise web server 5.2 4.12.0-1.redhat_1.1.el8jws
jws5-tomcat jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el6jws
jws5-tomcat jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el7jws
jws5-tomcat jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el8jws
jws5-tomcat-lib jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el6jws
jws5-tomcat-lib jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el7jws

red hat advisories RHSA-2019:3929

tomcat SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +1 more 9.0.31-3.25.1
tomcat SLE Module for Web and Scripting 15 9.0.30-3.34.1
tomcat SLE Module for Web and Scripting 15 SP1 9.0.30-4.10.1
tomcat SLES for SAP 12 SP4, SLES 12 SP4 9.0.21-3.13.2

suse advisories SUSE-SU-2020:0632-1 SUSE-SU-2020:0226-1 SUSE-SU-2020:0029-1 SUSE-SU-2019:1866-1

tomcat openSUSE Tumbleweed 9.0.36-8.4
tomcat10 openSUSE Tumbleweed 10.1.14-1.1
tomcat openSUSE Leap 15.1 9.0.30-lp151.3.6.1

opensuse advisories openSUSE-SU-2024:11468-1 openSUSE-SU-2024:13441-1 openSUSE-SU-2020:0038-1

Is CVE-2019-10072 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10072 updated 2026-11-05 cvss 5.3

tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199

Red Hat BPM Suite 6 tomcat Red Hat Enterprise Linux 8 pki-deps:10.6/pki-servlet-container Red Hat JBoss BRMS 6 tomcat
affected: workaround, no fix planned “pki-servlet-container does not use HTTP/2 in its default configuration.”
Red Hat JBoss Web Server 5
fixed: vendor fix “pki-servlet-container does not use HTTP/2 in its default configuration.” RHSA-2019:3931
Red Hat JBoss Web Server 5.2 for RHEL 6 Server jws5-ecj 4.12.0-1.redhat_1.1.el6jws, jws5-tomcat 9.0.21-10.redhat_4.1.el6jws, jws5-tomcat-lib 9.0.21-10.redhat_4.1.el6jws, jws5-javapackages-tools 3.4.1-5.15.11.el6jws, jws5-python-javapackages 3.4.1-5.15.11.el6jws, jws5-tomcat-native 1.2.21-34.redhat_34.el6jws, +13 more Red Hat JBoss Web Server 5.2 for RHEL 7 Server jws5-ecj 4.12.0-1.redhat_1.1.el7jws, jws5-tomcat 9.0.21-10.redhat_4.1.el7jws, jws5-tomcat-lib 9.0.21-10.redhat_4.1.el7jws, jws5-javapackages-tools 3.4.1-5.15.11.el7jws, jws5-python-javapackages 3.4.1-5.15.11.el7jws, jws5-tomcat-native 1.2.21-34.redhat_34.el7jws, +13 more Red Hat JBoss Web Server 5.2 for RHEL 8 jws5-ecj 4.12.0-1.redhat_1.1.el8jws, jws5-tomcat 9.0.21-10.redhat_4.1.el8jws, jws5-tomcat-lib 9.0.21-10.redhat_4.1.el8jws, jws5-javapackages-tools 3.4.1-5.15.11.el8jws, jws5-python-javapackages 3.4.1-5.15.11.el8jws, jws5-tomcat-native 1.2.21-34.redhat_34.el8jws, +13 more
fixed: vendor fix “pki-servlet-container does not use HTTP/2 in its default configuration.” RHSA-2019:3929
Red Hat Enterprise Linux 6 tomcat Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Fuse 7 tomcat Red Hat JBoss Data Grid 7 tomcat Red Hat JBoss Fuse 6 tomcat
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 7d ago (2026-11-02)

Exploit prediction

72.99% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.tomcat.embed:tomcat-embed-core	>=9.0.0.M1, <9.0.20 >=8.5.0, <8.5.41	9.0.20 8.5.41

Affected products

n/a Apache Tomcat

Classification

Weakness

CWE-667 Improper Locking

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json critical feed