Lucene search

ApacheCVE-2024-34750

HistoryJul 03, 2024 - 8:15 p.m.

CVE-2024-34750

2024-07-0320:15:04

CWE-400

CWE-755

apache

web.nvd.nist.gov

114

apache tomcat

http/2

handling vulnerability

excessive headers

dos

upgrade

version 11.0.0-m21

10.1.25

9.0.90

improper handling

resource consumption

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

Percentile

9.1%

JSON

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

Affected configurations

Vulners

Vulnrichment

Node

apache_software_foundationapache_strutsRange≤11.0.0-M20

apache_software_foundationapache_strutsRange≤10.1.24

apache_software_foundationapache_strutsRange≤9.0.89

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "11.0.0-M20",
        "status": "affected",
        "version": "11.0.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.1.24",
        "status": "affected",
        "version": "10.1.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.0.89",
        "status": "affected",
        "version": "9.0.0-M1",
        "versionType": "semver"
      }
    ]
  }
]