Fixed in Apache Tomcat 9.0.20

Important: Denial of Service CVE-2019-10072

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write. By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

This was fixed with commits 7f748eb6 and ada725a5.

This issue was reported to the Apache Tomcat Security Team by John Simpson of Trend Micro Security Research working with Trend Micro’s Zero Day Initiative on 26 April 2019. The issue was made public on 20 June 2019.

Affects: 9.0.0.M1 to 9.0.19