CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 7.5. It affects Apache. Its EPSS score suggests a 73.0% probability of exploitation in the next 30 days.
CVE
CVE-2019-10072
Severity
HIGH
CVSS
7.5
EPSS
72.99%
Apache
Original NVD Description
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Related CVEs
Other vulnerabilities affecting the same vendor(s)