Apache Tomcat versions prior to 11.0.0-M21, 10.1.25, and 9.0.90 contain a vulnerability in HTTP/2 stream processing where excessive HTTP headers are improperly handled. This causes miscounting of active HTTP/2 streams and results in an infinite timeout, allowing connections to remain open indefinitely. This can lead to denial of service by exhausting server resources. Users should upgrade to the fixed versions to resolve this issue.