Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2019-10072

Improper Locking

Published: Jun 21, 2019 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
5.3 MODERATE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2019-10072
CWEhttps://cwe.mitre.org/data/definitions/667.html

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Weakness

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Affected Software

NameVendorStart VersionEnd Version
TomcatApache8.5.0 (including)8.5.40 (including)
TomcatApache9.0.1 (including)9.0.19 (including)
TomcatApache9.0.0-milestone1 (including)9.0.0-milestone1 (including)
TomcatApache9.0.0-milestone10 (including)9.0.0-milestone10 (including)
TomcatApache9.0.0-milestone11 (including)9.0.0-milestone11 (including)
TomcatApache9.0.0-milestone12 (including)9.0.0-milestone12 (including)
TomcatApache9.0.0-milestone13 (including)9.0.0-milestone13 (including)
TomcatApache9.0.0-milestone14 (including)9.0.0-milestone14 (including)
TomcatApache9.0.0-milestone15 (including)9.0.0-milestone15 (including)
TomcatApache9.0.0-milestone16 (including)9.0.0-milestone16 (including)
TomcatApache9.0.0-milestone17 (including)9.0.0-milestone17 (including)
TomcatApache9.0.0-milestone18 (including)9.0.0-milestone18 (including)
TomcatApache9.0.0-milestone19 (including)9.0.0-milestone19 (including)
TomcatApache9.0.0-milestone2 (including)9.0.0-milestone2 (including)
TomcatApache9.0.0-milestone20 (including)9.0.0-milestone20 (including)
TomcatApache9.0.0-milestone21 (including)9.0.0-milestone21 (including)
TomcatApache9.0.0-milestone22 (including)9.0.0-milestone22 (including)
TomcatApache9.0.0-milestone23 (including)9.0.0-milestone23 (including)
TomcatApache9.0.0-milestone24 (including)9.0.0-milestone24 (including)
TomcatApache9.0.0-milestone25 (including)9.0.0-milestone25 (including)
TomcatApache9.0.0-milestone26 (including)9.0.0-milestone26 (including)
TomcatApache9.0.0-milestone27 (including)9.0.0-milestone27 (including)
TomcatApache9.0.0-milestone3 (including)9.0.0-milestone3 (including)
TomcatApache9.0.0-milestone4 (including)9.0.0-milestone4 (including)
TomcatApache9.0.0-milestone5 (including)9.0.0-milestone5 (including)
TomcatApache9.0.0-milestone6 (including)9.0.0-milestone6 (including)
TomcatApache9.0.0-milestone7 (including)9.0.0-milestone7 (including)
TomcatApache9.0.0-milestone8 (including)9.0.0-milestone8 (including)
TomcatApache9.0.0-milestone9 (including)9.0.0-milestone9 (including)
Red Hat JBoss Web Server 5RedHattomcat*
Red Hat JBoss Web Server 5.2 on RHEL 6RedHatjws5-ecj-0:4.12.0-1.redhat_1.1.el6jws*
Red Hat JBoss Web Server 5.2 on RHEL 6RedHatjws5-javapackages-tools-0:3.4.1-5.15.11.el6jws*
Red Hat JBoss Web Server 5.2 on RHEL 6RedHatjws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws*
Red Hat JBoss Web Server 5.2 on RHEL 6RedHatjws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws*
Red Hat JBoss Web Server 5.2 on RHEL 6RedHatjws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws*
Red Hat JBoss Web Server 5.2 on RHEL 6RedHatjws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws*
Red Hat JBoss Web Server 5.2 on RHEL 6RedHatjws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws*
Red Hat JBoss Web Server 5.2 on RHEL 7RedHatjws5-ecj-0:4.12.0-1.redhat_1.1.el7jws*
Red Hat JBoss Web Server 5.2 on RHEL 7RedHatjws5-javapackages-tools-0:3.4.1-5.15.11.el7jws*
Red Hat JBoss Web Server 5.2 on RHEL 7RedHatjws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws*
Red Hat JBoss Web Server 5.2 on RHEL 7RedHatjws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws*
Red Hat JBoss Web Server 5.2 on RHEL 7RedHatjws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws*
Red Hat JBoss Web Server 5.2 on RHEL 7RedHatjws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws*
Red Hat JBoss Web Server 5.2 on RHEL 7RedHatjws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws*
Red Hat JBoss Web Server 5.2 on RHEL 8RedHatjws5-ecj-0:4.12.0-1.redhat_1.1.el8jws*
Red Hat JBoss Web Server 5.2 on RHEL 8RedHatjws5-javapackages-tools-0:3.4.1-5.15.11.el8jws*
Red Hat JBoss Web Server 5.2 on RHEL 8RedHatjws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws*
Red Hat JBoss Web Server 5.2 on RHEL 8RedHatjws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws*
Red Hat JBoss Web Server 5.2 on RHEL 8RedHatjws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws*
Red Hat JBoss Web Server 5.2 on RHEL 8RedHatjws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws*
Red Hat JBoss Web Server 5.2 on RHEL 8RedHatjws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws*
Tomcat8Ubuntubionic*
Tomcat8Ubuntucosmic*
Tomcat8Ubuntuesm-apps/bionic*
Tomcat8Ubuntutrusty*
Tomcat8Ubuntuupstream*
Tomcat9Ubuntubionic*
Tomcat9Ubuntucosmic*
Tomcat9Ubuntudisco*
Tomcat9Ubuntuesm-apps/bionic*
Tomcat9Ubuntutrusty*
Tomcat9Ubuntuupstream*

Extended Description

Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use