Denial of service vulnerability in Apache Tomcat due to improper handling of an HTTP/2 GOAWAY frameID: oval:org.secpod.oval:def:40404 | Date: (C)2017-05-02 (M)2023-12-14 |
Class: VULNERABILITY | Family: windows |
The host is installed with Apache Tomcat 8.5.x before 8.5.13 or 9.x before 9.0.0.M19 and is prone to an denial of service vulnerability. A flaw is present in the Application, which fails to handle an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. Successful exploitation could allow malicious client to construct a series of HTTP/2 requests that would consume all available processing threads.
Platform: |
Microsoft Windows Server 2022 |
Microsoft Windows 11 |
Microsoft Windows Server 2019 |
Microsoft Windows 7 |
Microsoft Windows 8 |
Microsoft Windows Server 2003 |
Microsoft Windows 10 |
Microsoft Windows Server 2008 |
Microsoft Windows Vista |
Microsoft Windows XP |
Microsoft Windows 8.1 |
Microsoft Windows Server 2012 R2 |
Microsoft Windows Server 2008 R2 |
Microsoft Windows Server 2012 |
Microsoft Windows Server 2016 |