Executive brief
Apache Tomcat is a widely used web server and application container for Java-based websites. A vulnerability in its handling of HTTP/2 traffic allows an attacker to send a specific sequence of requests that causes the server's processor usage to spike. If enough of these requests are sent at once, the server can become completely unresponsive, leading to a denial of service for legitimate users.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in Apache Tomcat's HTTP/2 implementation. By sending a specifically crafted sequence of HTTP/2 requests, a remote, unauthenticated attacker can trigger high CPU usage for several seconds per request. When multiple such requests are sent concurrently over multiple connections, the cumulative CPU load can exhaust server resources, resulting in a denial-of-service (DoS) condition. The issue is resolved in Apache Tomcat versions 10.0.0-M5, 9.0.35, and 8.5.55.
Affected products
- Apache Tomcat 8.5.0 to 8.5.54, 9.0.0.M1 to 9.0.34, 10.0.0-M1 to 10.0.0-M4
- Apache tomcat-embed-core 8.5.0 to 8.5.54, 9.0.0.M1 to 9.0.34, 10.0.0-M1 to 10.0.0-M4
Timeline
- 2020-06-26: disclosed
- 2022-02-09: advisory