In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2…
Priority MEDIUM 44CWE-404Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-404.
Summary
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
Why it matters now
EPSS 0.08275 94th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 9.0.0.M19, 8.5.13
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 9.0.0.M1 to 9.0.0.M18; 8.5.0 to 8.5.12 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 9.0.0.M1 to before 9.0.0.M19 | 9.0.0.M19 | Patch available | GHSA-9785-w233-x6hv |
| — | org.apache.tomcat:tomcat (Maven) | 8.5.0 to before 8.5.13 | 8.5.13 | Patch available | GHSA-9785-w233-x6hv |
- Apache Tomcat VendorApache Affected 9.0.0.M1 to 9.0.0.M18; 8.5.0 to 8.5.12 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M19 Fixed in 9.0.0.M19 Patch available GHSA-9785-w233-x6hv
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.0 to before 8.5.13 Fixed in 8.5.13 Patch available GHSA-9785-w233-x6hv
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:* | 8.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:* | 8.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:* | 8.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:* | 8.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:* | 8.5.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:* | 8.5.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:* | 8.5.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:* | 8.5.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:* | 8.5.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:* | 8.5.9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:* Versions 8.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:* Versions 8.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:* Versions 8.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:* Versions 8.5.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:* Versions 8.5.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:* Versions 8.5.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:* Versions 8.5.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:* Versions 8.5.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:* Versions 8.5.9 Vulnerable ·Apache
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:* | 8.5.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:* | 8.5.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:* | 8.5.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* | 9.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* | 9.0.0 milestone16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* | 9.0.0 milestone17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* | 9.0.0 milestone18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* | 9.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* | 9.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* | 9.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:* Versions 8.5.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:* Versions 8.5.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:* Versions 8.5.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
Remediation
- Fix · GHSA-9785-w233-x6hv org.apache.tomcat:tomcat (Maven) Fixed in 9.0.0.M19 Advisory →
- Fix · GHSA-9785-w233-x6hv org.apache.tomcat:tomcat (Maven) Fixed in 8.5.13 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 16 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss BRMS 5
- Red Hat JBoss Data Grid 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Web Server 2
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Operations Network 3
- Red Hat JBoss Portal 6
- Red Hat JBoss SOA Platform 5
- Red Hat JBoss Web Server 3
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5650
- 2026-10-03 Alias added: GHSA-9785-w233-x6hv
References
Other 24
- https://security.netapp.com/advisory/ntap-20180614-0001/
- [users] 20170410 [SECURITY] CVE-2017-5650 Apache Tomcat Denial of Service
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/2cb9c724e6a2d15a5bc909c4bf1ab9dfc26fa362
- https://github.com/apache/tomcat/commit/5496e193a89b8b8b3177e516358df2f07ab852b3
- https://web.archive.org/web/20170906032952/http://www.securitytracker.com/id/1038217
- https://web.archive.org/web/20170417124144/http://www.securityfocus.com/bid/97531
- https://security.netapp.com/advisory/ntap-20180614-0001
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/d24303fb095db072740d8154b0f0db3f2b8f67bc91a0562dbe89c738@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2017-5650 · CVE Program
- CVE-2017-5650 · NVD
- FIRST EPSS
- GHSA-9785-w233-x6hv · GitHub Advisory Database · CC BY 4.0
- CVE-2017-5650 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences