PT-2024-2566 · Apache+11 · Apache Tomcat+12
Mark Thomas
·
Published
2024-02-19
·
Updated
2026-03-26
·
CVE-2024-23672
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 11.0.0-M1 through 11.0.0-M16
Apache Tomcat versions 10.1.0-M1 through 10.1.18
Apache Tomcat versions 9.0.0-M1 through 9.0.85
Apache Tomcat versions 8.5.0 through 8.5.98
Description
The issue is related to a Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open, leading to increased resource consumption.
Recommendations
Upgrade to version 11.0.0-M17 to fix the issue for versions 11.0.0-M1 through 11.0.0-M16.
Upgrade to version 10.1.19 to fix the issue for versions 10.1.0-M1 through 10.1.18.
Upgrade to version 9.0.86 to fix the issue for versions 9.0.0-M1 through 9.0.85.
Upgrade to version 8.5.99 to fix the issue for versions 8.5.0 through 8.5.98.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Apache Tomcat
Astra Linux
Centos
Confluence
Jira
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu