The Virsec Security Research Lab provides detailed analysis on recent and notable security vulnerabilities.
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If enough of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
Watch the video to learn more about this and other important vulnerabilities.
The CVSS Base Score is 7.5 (High)
Apache Tomcat 10.0.0-M1 to 10.0.0-M5
Apache Tomcat 9.0.0.M1 to 9.0.35
Apache Tomcat 8.5.0 to 8.5.55 (March 2016)
This issue was reported publicly via the Apache Tomcat Users mailing list without reference to the potential for DoS. The DoS risks were identified by the Apache Tomcat Security Team.
A publicly disclosed exploit code is available here. Based on this link from 2010, Apache Tomcat has been downloaded 10 Million times. Tomcat has 60% market share of Java Application servers. Given that Apache Tomcat powers a broad range of web applications across countless industries and use cases, from Fortune 500 conglomerates to service providers to eCommerce systems, it is reasonable to estimate that 10s of millions of this software are in use.
The Virsec Security Platform (VSP)-Mem’s exception handling capability can be used to identify the malicious traffic and then the VSP Protection Engine can fire an upstream Protection Action into VSP-APG which will drop the so called “specially crafted” HTTP/2 packet.
Download the full vulnerability report to learn more about this and other important vulnerabilities.
Jump to: List of CVE Vulnerabilities