REDHAT-BUG-2295651: High severity tomcat vulnerability
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.
Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2295651?
The severity of REDHAT-BUG-2295651 is categorized as moderate.
How do I fix REDHAT-BUG-2295651?
To fix REDHAT-BUG-2295651, upgrade to the latest patched version of Apache Tomcat as recommended in the errata.
What versions of Apache Tomcat are affected by REDHAT-BUG-2295651?
Affected versions include Apache Tomcat from 9.0.0-M1 to 9.0.89, 10.1.0-M1 to 10.1.24, and 11.0.0-M1 to 11.0.0-M20.
What kind of vulnerability is REDHAT-BUG-2295651?
REDHAT-BUG-2295651 is classified as an Improper Handling of Exceptional Conditions vulnerability, leading to potential resource exhaustion.
What risks are posed by REDHAT-BUG-2295651?
The risks include the possibility of excessive resource consumption and denial of service due to mismanagement of HTTP/2 streams.