tomcat: RCE due to TOCTOU issue in JSP compilation

🗓️ 16 Jan 2025 19:35:08Reported by RedHatType

Tomcat remote code execution via a timing race during JSP compilation on case-insensitive file systems when the default servlet writes; uploaded files may execute as JSP.

Reporter	Title	Published	Views	Family All 290
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Dec 202421:30	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	19 Dec 202402:43	–	githubexploit
GithubExploit	Exploit for CVE-2025-55752	29 Oct 202508:27	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	23 Dec 202414:11	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	25 Dec 202418:42	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	18 Dec 202419:53	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	30 Mar 202517:15	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Jun 202616:07	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Dec 202405:24	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	21 Dec 202405:54	–	githubexploit

Vulners

Node

AND

redhat jboss_enterprise_web_serverRange<5.8

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-50379
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-50379
cve	www.cve.org/CVERecord

18 Mar 2026 02:49Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

EPSS0.44312

SSVC

CWE-367