---
id: CVE-2019-10072
title: >-
  The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection
  window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and
  8.5.0 to 8.5.40 
summary: >-
  The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection
  window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and
  8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection
  window …
severity: none
product: Apache Tomcat
affected:
  - 'apache_tomcat Apache Tomcat 9.0.0.M1 to 9.0.19, 8.5.0 to 8.5.40'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:30:53.444624Z'
published: '2019-06-21'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:31:07.478Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2019-10072'
references:
  - url: 'http://www.securityfocus.com/bid/108874'
    label: '108874'
  - url: 'https://usn.ubuntu.com/4128-1/'
    label: USN-4128-1
  - url: 'https://usn.ubuntu.com/4128-2/'
    label: USN-4128-2
  - url: 'https://access.redhat.com/errata/RHSA-2019:3929'
    label: 'RHSA-2019:3929'
  - url: 'https://access.redhat.com/errata/RHSA-2019:3931'
    label: 'RHSA-2019:3931'
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html'
    label: 'openSUSE-SU-2020:0038'
  - url: >-
      https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200203 svn commit: r1873527 [24/30] -
      /tomcat/site/trunk/docs/
  - url: >-
      https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200203 svn commit: r1873527 [25/30] -
      /tomcat/site/trunk/docs/
  - url: >-
      https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200213 svn commit: r1873980 [28/34] -
      /tomcat/site/trunk/docs/
  - url: >-
      https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200213 svn commit: r1873980 [29/34] -
      /tomcat/site/trunk/docs/
  - url: 'https://www.debian.org/security/2020/dsa-4680'
    label: DSA-4680
  - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html'
  - url: >-
      https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
  - url: 'https://www.oracle.com/security-alerts/cpujan2020.html'
  - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html'
  - url: >-
      https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E
  - url: 'https://www.synology.com/security/advisory/Synology_SA_19_29'
  - url: 'https://security.netapp.com/advisory/ntap-20190625-0002/'
  - url: 'https://support.f5.com/csp/article/K17321505'
  - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html'
tags:
  - cve.org
epss: 0.72988
epssPercentile: 0.99456
ingestedAt: '2026-11-05T19:30:42.730Z'
---

## Overview

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

## Affected

- `apache_tomcat Apache Tomcat 9.0.0.M1 to 9.0.19, 8.5.0 to 8.5.40`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.