queuedRunnable = null;
+
++ // Track 'overhead' frames vs 'request/response' frames
++ private final AtomicLong overheadCount = new AtomicLong(-10);
++
+
+ Http2UpgradeHandler(Http2Protocol protocol, Adapter adapter, Request coyoteRequest) {
+ super (STREAM_ID_ZERO);
+@@ -330,6 +334,10 @@
+ }
+ }
+
++ if (overheadCount.get() > 0) {
++ throw new ConnectionException("Too much overhead", Http2Error.ENHANCE_YOUR_CALM);
++ }
++
+ if (activeRemoteStreamCount.get() == 0) {
+ // No streams currently active. Use the keep-alive
+ // timeout for the connection.
+@@ -638,6 +646,9 @@
+ log.debug(sm.getString("upgradeHandler.writeBody", connectionId, stream.getIdentifier(),
+ Integer.toString(len)));
+ }
++
++ reduceOverheadCount();
++
+ // Need to check this now since sending end of stream will change this.
+ boolean writeable = stream.canWrite();
+ byte[] header = new byte[9];
+@@ -1193,6 +1204,16 @@
+ }
+
+
++ private void reduceOverheadCount() {
++ overheadCount.decrementAndGet();
++ }
++
++
++ private void increaseOverheadCount() {
++ overheadCount.addAndGet(getProtocol().getOverheadCountFactor());
++ }
++
++
+ // ----------------------------------------------- Http2Parser.Input methods
+
+ @Override
+@@ -1247,6 +1268,7 @@
+
+ @Override
+ public ByteBuffer startRequestBodyFrame(int streamId, int payloadSize) throws Http2Exception {
++ reduceOverheadCount();
+ Stream stream = getStream(streamId, true);
+ stream.checkState(FrameType.DATA);
+ stream.receivedData(payloadSize);
+@@ -1291,6 +1313,8 @@
+ // determines if a new stream is created or if this stream is ignored.
+ checkPauseState();
+
++ reduceOverheadCount();
++
+ if (connectionState.get().isNewStreamAllowed()) {
+ Stream stream = getStream(streamId, false);
+ if (stream == null) {
+@@ -1340,6 +1364,9 @@
+ throw new ConnectionException(sm.getString("upgradeHandler.dependency.invalid",
+ getConnectionId(), Integer.valueOf(streamId)), Http2Error.PROTOCOL_ERROR);
+ }
++
++ increaseOverheadCount();
++
+ Stream stream = getStream(streamId, false);
+ if (stream == null) {
+ stream = createRemoteStream(streamId);
+@@ -1384,6 +1411,9 @@
+
+ @Override
+ public void setting(Setting setting, long value) throws ConnectionException {
++
++ increaseOverheadCount();
++
+ // Special handling required
+ if (setting == Setting.INITIAL_WINDOW_SIZE) {
+ long oldValue = remoteSettings.getInitialWindowSize();
+@@ -1425,6 +1455,9 @@
+
+ @Override
+ public void pingReceive(byte[] payload, boolean ack) throws IOException {
++ if (!ack) {
++ increaseOverheadCount();
++ }
+ pingManager.receivePing(payload, ack);
+ }
+
+
diff --git a/CVE-2019-0199-6.patch b/CVE-2019-0199-6.patch
new file mode 100644
index 0000000..ef1ed8d
--- /dev/null
+++ b/CVE-2019-0199-6.patch
@@ -0,0 +1,51 @@
+--- tomcat/webapps/docs/config/http2.xml 2019/02/01 10:28:22 1852702
++++ tomcat/webapps/docs/config/http2.xml 2019/02/01 10:28:26 1852703
+@@ -125,9 +125,9 @@
+
+
+ The time, in milliseconds, that Tomcat will wait between HTTP/2 frames
+- before closing the connection. Negative values will be treated as an
+- infinite timeout. If not specified, a default value of -1
+- will be used.
++ when there is no active Stream before closing the connection. Negative
++ values will be treated as an infinite timeout. If not specified, a default
++ value of 20000 will be used.
+
+
+
+@@ -192,7 +192,24 @@
+ The time, in milliseconds, that Tomcat will wait for additional data
+ when a partial HTTP/2 frame has been received. Negative values will be
+ treated as an infinite timeout. If not specified, a default value of
+- 10000 will be used.
++ 5000 will be used.
++
++
++
++ The time, in milliseconds, that Tomcat will wait for additional data
++ frames to arrive for the stream when an application is performing a
++ blocking I/O read and additional data is required. Negative values will be
++ treated as an infinite timeout. If not specified, a default value of
++ 20000 will be used.
++
++
++
++ The time, in milliseconds, that Tomcat will wait for additional window
++ update frames to arrive for the stream and/or conenction when an
++ application is performing a blocking I/O write and the stream and/or
++ connection flow control window is too small for the write to complete.
++ Negative values will be treated as an infinite timeout. If not specified,
++ a default value of 20000 will be used.
+
+
+
+@@ -204,7 +221,7 @@
+ The time, in milliseconds, that Tomcat will wait to write additional
+ data when an HTTP/2 frame has been partially written. Negative values will
+ be treated as an infinite timeout. If not specified, a default value of
+- 10000 will be used.
++ 5000 will be used.
+
+
+
+
diff --git a/CVE-2019-0199-7.patch b/CVE-2019-0199-7.patch
new file mode 100644
index 0000000..0369108
--- /dev/null
+++ b/CVE-2019-0199-7.patch
@@ -0,0 +1,32 @@
+diff -Nurp apache-tomcat-9.0.10-src/java/org/apache/coyote/http2/Stream.java apache-tomcat-9.0.10-src-bak/java/org/apache/coyote/http2/Stream.java
+--- apache-tomcat-9.0.10-src/java/org/apache/coyote/http2/Stream.java 2019-06-09 20:59:53.027000000 -0400
++++ apache-tomcat-9.0.10-src-bak/java/org/apache/coyote/http2/Stream.java 2019-06-09 21:02:31.878000000 -0400
+@@ -211,7 +211,12 @@ class Stream extends AbstractStream impl
+ }
+ try {
+ if (block) {
+- wait(handler.getProtocol().getStreamWriteTimeout());
++ long writeTimeout = handler.getProtocol().getStreamWriteTimeout();
++ if (writeTimeout < 0) {
++ wait();
++ } else {
++ wait(writeTimeout);
++ }
+ windowSize = getWindowSize();
+ if (windowSize == 0) {
+ String msg = sm.getString("stream.writeTimeout");
+@@ -889,7 +894,12 @@ class Stream extends AbstractStream impl
+ log.debug(sm.getString("stream.inputBuffer.empty"));
+ }
+
+- inBuffer.wait(handler.getProtocol().getStreamReadTimeout());
++ long readTimeout = handler.getProtocol().getStreamReadTimeout();
++ if (readTimeout < 0) {
++ inBuffer.wait();
++ } else {
++ inBuffer.wait(readTimeout);
++ }
+
+ if (reset) {
+ throw new IOException(sm.getString("stream.inputBuffer.reset"));
+
diff --git a/CVE-2019-0199-8.patch b/CVE-2019-0199-8.patch
new file mode 100644
index 0000000..f921ed2
--- /dev/null
+++ b/CVE-2019-0199-8.patch
@@ -0,0 +1,24 @@
+--- tomcat/java/org/apache/coyote/http2/Http2UpgradeHandler.java 2019/02/01 10:28:30 1852704
++++ tomcat/java/org/apache/coyote/http2/Http2UpgradeHandler.java 2019/02/01 10:28:34 1852705
+@@ -335,7 +335,9 @@
+ }
+
+ if (overheadCount.get() > 0) {
+- throw new ConnectionException("Too much overhead", Http2Error.ENHANCE_YOUR_CALM);
++ throw new ConnectionException(
++ sm.getString("upgradeHandler.tooMuchOverhead", connectionId),
++ Http2Error.ENHANCE_YOUR_CALM);
+ }
+
+ if (activeRemoteStreamCount.get() == 0) {
+--- tomcat/java/org/apache/coyote/http2/LocalStrings.properties 2019/02/01 10:28:30 1852704
++++ tomcat/java/org/apache/coyote/http2/LocalStrings.properties 2019/02/01 10:28:34 1852705
+@@ -141,6 +141,7 @@
+ upgradeHandler.stream.notWritable=Connection [{0}], Stream [{1}], This stream is not writable
+ upgradeHandler.stream.old=A new remote stream ID of [{0}] was requested but the most recent stream was [{1}]
+ upgradeHandler.tooManyRemoteStreams=The client attempted to use more than [{0}] active streams
++upgradeHandler.tooMuchOverhead=Connection [{0}], Too much overhead so the connection will be closed
+ upgradeHandler.unexpectedAck=Connection [{0}], Stream [{1}], A settings acknowledgement was received when not expected
+ upgradeHandler.unexpectedEos=Unexpected end of stream
+ upgradeHandler.upgrade=Connection [{0}], HTTP/1.1 upgrade to stream [1]
+
diff --git a/CVE-2019-0199-9.patch b/CVE-2019-0199-9.patch
new file mode 100644
index 0000000..78c22a1
--- /dev/null
+++ b/CVE-2019-0199-9.patch
@@ -0,0 +1,24 @@
+--- tomcat/webapps/docs/config/http2.xml 2019/02/01 10:28:34 1852705
++++ tomcat/webapps/docs/config/http2.xml 2019/02/01 10:28:38 1852706
+@@ -188,6 +188,20 @@
+ The default value is an empty String (regexp matching disabled).
+
+
++
++ The factor to apply when counting overhead frames to determine if a
++ connection has too high an overhead and should be closed. The overhead
++ count starts at -10. The count is decreased for each
++ data frame sent or received and each headers frame received. The count is
++ increased by the overheadCountFactorfor each setting
++ received, priority frame received and ping received. If the overhead count
++ exceeds zero, the connection is closed. A value of less than
++ 1 disables this protection. In normal usage a value of
++ 3 or more will close the connection before any streams can
++ complete. If not specified, a default value of 1 will be
++ used.
++
++
+
+ The time, in milliseconds, that Tomcat will wait for additional data
+ when a partial HTTP/2 frame has been received. Negative values will be
+
diff --git a/CVE-2019-0221.patch b/CVE-2019-0221.patch
new file mode 100644
index 0000000..cc2c366
--- /dev/null
+++ b/CVE-2019-0221.patch
@@ -0,0 +1,44 @@
+From 15fcd166ea2c1bb79e8541b8e1a43da9c452ceea Mon Sep 17 00:00:00 2001
+From: Mark Thomas
+Date: Mon, 11 Mar 2019 11:33:03 +0000
+Subject: [PATCH] Escape debug output to aid readability
+
+reason: Escape debug output to aid readability, fix CVE CVE-2019-0221
+https://github.com/apache/tomcat/commit/15fcd16
+
+---
+ java/org/apache/catalina/ssi/SSIPrintenv.java | 3 +--
+ webapps/docs/changelog.xml | 3 +++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/java/org/apache/catalina/ssi/SSIPrintenv.java b/java/org/apache/catalina/ssi/SSIPrintenv.java
+index 97470b2..092542f 100644
+--- a/java/org/apache/catalina/ssi/SSIPrintenv.java
++++ b/java/org/apache/catalina/ssi/SSIPrintenv.java
+@@ -41,8 +41,7 @@ public class SSIPrintenv implements SSICommand {
+ } else {
+ Collection variableNames = ssiMediator.getVariableNames();
+ for (String variableName : variableNames) {
+- String variableValue = ssiMediator
+- .getVariableValue(variableName);
++ String variableValue = ssiMediator.getVariableValue(variableName, "entity");
+ //This shouldn't happen, since all the variable names must
+ // have values
+ if (variableValue == null) {
+diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
+index 697cf07..cbd3961 100644
+--- a/webapps/docs/changelog.xml
++++ b/webapps/docs/changelog.xml
+@@ -52,6 +52,9 @@
+ Expires header as required by HTTP specification
+ (RFC 7231, 7234). (kkolinko)
+
++
++ Encode the output of the SSI printenv command. (markt)
++
+
+