A high-severity denial of service vulnerability in Apache Tomcat allows unauthenticated remote attackers to exhaust system resources by triggering an allocation leak in the HTTP/2 stream management process.

This vulnerability (CWE-400) involves an uncontrolled resource consumption flaw where an allocation leak occurs within the HTTP/2 backlog tracking logic during stream resets. This allows an unauthenticated attacker to remotely induce a denial of service state by repeatedly sending specifically crafted stream reset requests.

Successful exploitation of this vulnerability can result in significant service disruption and downtime for applications relying on the affected Apache Tomcat instances. Given the CVSS score of 7.5, the risk is elevated because the attack vector is network-based and requires no authentication, making it trivial for malicious actors to target internet-facing servers.

Immediate Action: Upgrade to Apache Tomcat version 11.0.25, 10.1.58, or 9.0.121 as recommended by the vendor to resolve the allocation leak.

Proactive Monitoring: Monitor server memory usage and HTTP/2 connection metrics for unusual spikes or patterns consistent with resource exhaustion attacks.

Compensating Controls: Deploy a Web Application Firewall or load balancer to inspect and limit HTTP/2 traffic, potentially blocking malformed or excessive stream reset requests until patches are applied.

Public Exploit Available: No

Organizations running the affected versions of Apache Tomcat should prioritize patching to the latest stable release. The combination of high severity and the lack of required authentication necessitates an urgent update schedule to prevent potential service degradation.