Denial Of Service (DoS)

2024-03-1620:57:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

denial of service

org.apache.tomcat

tomcat-coyote

http/2

request handling

headers

vulnerability

attacker

attacks

software

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

JSON

org.apache.tomcat, tomcat-coyote is vulnerable to Denial of Service (DoS). The vulnerability is due to improper request handling when processing an HTTP/2 request that exceeds any of the configured limits for headers, leading to the associated HTTP/2 stream not being reset until after all of the headers had been processed. This vulnerability allows an attacker to send requests with excessively large headers or too many headers which can result in Denial Of Service (DoS) attacks.

CPENameOperatorVersion
tomcat9:sideq9.0.40-1
tomcat-embed-corele11.0.0-M16
tomcat-embed-corele10.1.18
tomcat-embed-corele9.0.85
tomcat-embed-corele8.5.98
tomcat-coyotele11.0.0-M16
tomcat-coyotele10.1.18
tomcat-coyotele9.0.85
tomcat-coyotele8.5.98
tomcat9:bustereq9.0.31-1~deb10u2

Name	Operator	Version
tomcat9:sid	eq	9.0.40-1
tomcat-embed-core	le	11.0.0-M16
tomcat-embed-core	le	10.1.18
tomcat-embed-core	le	9.0.85
tomcat-embed-core	le	8.5.98
tomcat-coyote	le	11.0.0-M16
tomcat-coyote	le	10.1.18
tomcat-coyote	le	9.0.85
tomcat-coyote	le	8.5.98
tomcat9:buster	eq	9.0.31-1~deb10u2