Lucene search

GoogleOSV:BIT-TOMCAT-2024-23672

HistoryApr 01, 2024 - 2:18 p.m.

BIT-tomcat-2024-23672

2024-04-0114:18:43

Google

osv.dev

denial of service

apache tomcat

websocket

vulnerability

resource consumption

upgrade

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.1%

JSON

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

CPENameOperatorVersion
tomcatge9.0.0
tomcatlt11.0.0
tomcatlt10.1.19
tomcatlt9.0.86
tomcatlt8.5.99
tomcatge11.0.0
tomcatge8.5.0
tomcatge10.1.0

Name	Operator	Version
tomcat	ge	9.0.0
tomcat	lt	11.0.0
tomcat	lt	10.1.19
tomcat	lt	9.0.86
tomcat	lt	8.5.99
tomcat	ge	11.0.0
tomcat	ge	8.5.0
tomcat	ge	10.1.0

References

www.openwall.com/lists/oss-security/2024/03/13/4

lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f

lists.debian.org/debian-lts-announce/2024/04/msg00001.html

security.netapp.com/advisory/ntap-20240402-0002/