Listen to this Post
This vulnerability occurs in Apache Tomcat’s Coyote component when handling HTTP/2 connections. If a malicious client ignores the initial settings frame that limits concurrent streams, it can cause uncontrolled resource consumption. The server expects the client to acknowledge the reduced stream limit, but an attacker can flood the server with excessive streams, leading to memory exhaustion and denial of service. Affected versions include Tomcat 11.0.0-M1 to 11.0.8, 10.1.0-M1 to 10.1.42, and 9.0.0.M1 to 9.0.106.
DailyCVE Form
Platform: Apache Tomcat
Version: 9.0.0-11.0.8
Vulnerability: HTTP/2 DoS
Severity: Moderate
Date: Jul 10, 2025
Prediction: Patch by Jul 25, 2025
What Undercode Say
Check Tomcat version ./catalina.sh version Monitor HTTP/2 streams netstat -anp | grep :8080 Mitigation (before patch) server.max-http2-streams=100
How Exploit
- Attacker sends unacknowledged HTTP/2 streams
- Server fails to enforce stream limit
- Memory exhaustion causes service crash
Protection from this CVE
- Upgrade to Tomcat 11.0.9/10.1.43/9.0.107
- Limit HTTP/2 stream count
- Use reverse proxy with rate-limiting
Impact
- Service disruption
- Memory exhaustion
- Unresponsive applications
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
