CVE-2024-54677: Apache Tomcat: DoS in examples web application
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Other sources
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 9.0.98 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 10.1.34 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 11.0.2 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.2 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.34 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.98
Event History
Frequently Asked Questions
What is the severity of CVE-2024-54677?
CVE-2024-54677 is classified as a denial of service vulnerability.
How do I fix CVE-2024-54677?
To fix CVE-2024-54677, upgrade your Apache Tomcat installation to version 9.0.98, 10.1.34, or 11.0.2.
Which versions of Apache Tomcat are affected by CVE-2024-54677?
CVE-2024-54677 affects Apache Tomcat versions from 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.9.97.
What type of vulnerability is CVE-2024-54677?
CVE-2024-54677 is an uncontrolled resource consumption vulnerability.
What can happen if CVE-2024-54677 is exploited?
If exploited, CVE-2024-54677 can lead to denial of service, impacting the availability of the affected web application.