CVE-2019-10072: The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in A

This week

HIGH 7.5REMOTEWATCHLISTUPGRADE

CVE-2019-10072 is a high-severity flaw (CVSS 7.5) affecting tomcat. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	73.0% (top 1%)
CISA exploited list	No
Weakness	CWE-667
Published	2019-06-21
Last modified	2026-11-02

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-11-02 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-06-21 18:15 UTCPublished CVE record published
2026-11-02 18:18 UTCUpdated Record last modified

apache tomcat UPGRADE

Affected: >= 8.5.0 and <= 8.5.40 · >= 9.0.1 and <= 9.0.19 · 9.0.0 milestone1 · 9.0.0 milestone10 · 9.0.0 milestone11 · 9.0.0 milestone12 · 9.0.0 milestone13 · 9.0.0 milestone14

Fixed in: newer than 9.0.19

Safe to downgrade to: a release before 8.5.0

1. Check installed version

apt-cache policy tomcat || rpm -q tomcat || tomcat --version

2. UPGRADE to newer than 9.0.19 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade tomcat

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade tomcat

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.5.0 (Debian / Ubuntu)

apt-cache madison tomcat sudo apt install tomcat=<VERSION_BEFORE_8.5.0> sudo apt-mark hold tomcat

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list tomcat sudo dnf downgrade tomcat-<VERSION_BEFORE_8.5.0> sudo dnf versionlock add tomcat

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-10072?

tomcat: upgrade to newer than 9.0.19. Exact commands for each OS are on this page.

Is CVE-2019-10072 being exploited?

CVE-2019-10072 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-10072 affect?

CVE-2019-10072 affects tomcat. Severity is high (CVSS 7.5). The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (st

How urgent is CVE-2019-10072?

Priority 61/100. High severity; EPSS top 1%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist

Software pages

Apache Tomcat vulnerabilities

Related CVEs

CVE-2019-0232 HIGH 8.1 UPGRADE When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.
CVE-2019-0221 MEDIUM 6.1 UPGRADE The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes use
CVE-2017-5647 HIGH 7.5 DOWNGRADE A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0
CVE-2026-34486 HIGH 7.5 EXPLOITED DOWNGRADE DOWNGRADE Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
CVE-2026-29146 HIGH 7.5 UPGRADE Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue aff

References

← Back to latest CVEs