Fixed in Apache Tomcat 8.5.38

Important: Denial of Service CVE-2019-0199

The HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API’s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

This was fixed in revisions 1852707, 1852711, 1852712, 1852713, 1852714, 1852715, 1852717, 1852718, 1852719, 1852722, 1852723, 1852724 and 60a3af17.

This issue was reported to the Apache Tomcat Security Team by Michal Karm Babacek from Red Hat, Inc on 4 January 2019 with additional issues identified by the Tomcat Security Team. The issue was made public on 25 March 2019.

Affects: 8.5.0 to 8.5.37