The vulnerability of the Apache Tomcat application server, related to synchronization errors when using shared resources, allows attackers to execute arbitrary code.

🗓️ 25 Dec 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Tomcat vulnerability enables code execution via synchronization errors with shared resources.

Reporter	Title	Published	Views	Family All 177
IBM Security Bulletins	Security Bulletin: IBM Integration Bus for z/OS is vulnerable to a remote attack and a race condition vulnerability due to Apache Tomcat (CVE-2024-56337, CVE-2024-52316 and CVE-2024-50379)	28 Jan 202521:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a TOCTOU Race Condition vulnerability in Apache Tomcat [CVE-2024-56337]	27 Feb 202515:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to a Race Condition vulnerability in Apache Tomcat [CVE-2024-56337]	1 May 202519:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat might affect IBM Storage Defender Copy Data Management.	16 May 202519:24	–	ibm
IBM Security Bulletins	Security Bulletin: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability affects watsonx.data	3 Mar 202511:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-core	10 Mar 202518:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component uses CVE-2024-56337 tomcat-embed-core-10.1.33.jar (Publicly disclosed vulnerability found by Mend) CVE-2024-56337	20 Feb 202505:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Analytics Content Hub is affected by security vulnerabilities	9 Jul 202523:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	15 Apr 202502:36	–	ibm
Tenable Nessus	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-813)	24 Jan 202500:00	–	nessus

Vulners

Node

apache tomcatRange11.0.0-m1–11.0.1

apache tomcatRange10.1.0-m1–10.1.33

apache tomcatRange9.0.0.m1–9.0.97

axiom_jdk libercat_certifiedRange<9.0.107-1

axiom_jdk libercat_certifiedRange<10.1.43-1

Source	Link
lists	www.lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp
securitylab	www.securitylab.ru/news/555055.php
vuldb	www.vuldb.com/
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-tomcat-cve-2024-56337/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
web	www.web.nvd.nist.gov/view/vuln/detail

27 Jan 2026 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 24

CVSS 34.6

EPSS0.08856