Denial of Service via incomplete cleanup vulnerability in Apache Tomcat

2024-03-1318:31:34

Google

osv.dev

denial of service

apache tomcat

websocket connections

upgrade

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.6%

JSON

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.

Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

CPENameOperatorVersion
org.apache.tomcat.embed:tomcat-embed-websocketeq9.0.21
org.apache.tomcat:tomcat-websocketeq10.1.0-M14
org.apache.tomcat:tomcat-websocketeq9.0.40
org.apache.tomcat.embed:tomcat-embed-websocketeq10.1.2
org.apache.tomcat.embed:tomcat-embed-websocketeq8.5.58
org.apache.tomcat:tomcat-websocketeq8.5.15
org.apache.tomcat.embed:tomcat-embed-websocketeq9.0.0.M13
org.apache.tomcat:tomcat-websocketeq9.0.5
org.apache.tomcat.embed:tomcat-embed-websocketeq9.0.27
org.apache.tomcat:tomcat-websocketeq10.1.2

Name	Operator	Version
org.apache.tomcat.embed:tomcat-embed-websocket	eq	9.0.21
org.apache.tomcat:tomcat-websocket	eq	10.1.0-M14
org.apache.tomcat:tomcat-websocket	eq	9.0.40
org.apache.tomcat.embed:tomcat-embed-websocket	eq	10.1.2
org.apache.tomcat.embed:tomcat-embed-websocket	eq	8.5.58
org.apache.tomcat:tomcat-websocket	eq	8.5.15
org.apache.tomcat.embed:tomcat-embed-websocket	eq	9.0.0.M13
org.apache.tomcat:tomcat-websocket	eq	9.0.5
org.apache.tomcat.embed:tomcat-embed-websocket	eq	9.0.27
org.apache.tomcat:tomcat-websocket	eq	10.1.2