Bug 2381601 (BIT-tomcat-2024-34750)

Summary:	tomcat: Apache Tomcat HTTP/2 timeout
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aakkiang, aschwart, asoldano, bbaranow, bmaxwell, boliveir, brian.stansberry, cfu, csutherl, darran.lofthouse, dhanak, dkreling, dosoudil, drosa, dsirrine, edewata, gkimetto, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jclere, jmagne, jrokos, kverlaen, mfargett, mnovotny, mosmerov, mposolda, msochure, msvehla, nwallace, pdelbell, pesilva, pjindal, plodge, pmackay, prisingh, rstancel, rstepani, sausingh, sdawley, skhandel, smaestri, ssilvert, sthorger, szappis, taherrin, teagle, tom.jenkinson, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A denial of service flaw has been discovered in Apache Tomcat. This flaw relates to the handling of HTTP/2 streams and in some cases a header counting issue will lead to an infinite loop. This loop will prevent new connections and will functionally disable the web server.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-17 09:01:05 UTC

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.