CVE-2024-38286: Apache Tomcat: Denial of Service
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.
The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.
Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
Other sources
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.
Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-utilto a version that resolves this vulnerability.Fixed in 9.0.90 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-utilto a version that resolves this vulnerability.Fixed in 10.1.25 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-utilto a version that resolves this vulnerability.Fixed in 11.0.0-M21 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.0-M21 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.25 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.90 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in CVE-2024-38286
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38286?
CVE-2024-38286 is classified as a high severity vulnerability due to its potential to impact system performance and availability.
How do I fix CVE-2024-38286?
To address CVE-2024-38286, you should upgrade to Apache Tomcat version 9.0.90, 10.1.25, or 11.0.0-M21 depending on your current version.
Which versions of Apache Tomcat are affected by CVE-2024-38286?
CVE-2024-38286 affects Apache Tomcat versions from 11.0.0-M1 to 11.0.0-M20, 10.1.0-M1 to 10.1.24, and 9.0.13 to 9.0.89.
Can older versions of Apache Tomcat be affected by CVE-2024-38286?
Yes, older unsupported versions of Apache Tomcat may also be affected by CVE-2024-38286.
What is the nature of the vulnerability CVE-2024-38286?
CVE-2024-38286 is an Allocation of Resources Without Limits or Throttling vulnerability, which can allow excessive resource consumption.