cve/2019/CVE-2019-0199.md

CVE-2019-0199

Description

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

POC

Reference

• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpujan2020.html

Github

• https://github.com/ilmari666/cybsec
• https://github.com/vshaliii/Basic-Pentesting-2-Vulnhub-Walkthrough