Fixed in Apache Tomcat 9.0.90

Important: Denial of Service CVE-2024-34750

When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

This was fixed with commit 9fec9a82.

This issue was reported to the Tomcat Security Team on 4 May 2024. The issue was made public on 3 July 2024.

Affects: 9.0.0-M1 to 9.0.89