Vulnerability Details : CVE-2024-24549
Potential exploit
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.
Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
Vulnerability category: Denial of service
Products affected by CVE-2024-24549
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2024-24549
41.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2024-24549
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-11-04 |
CWE ids for CVE-2024-24549
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: security@apache.org (Secondary)
References for CVE-2024-24549
-
https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html
[SECURITY] [DLA 3779-1] tomcat9 security update
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/
[SECURITY] Fedora 40 Update: tomcat-9.0.89-1.fc40 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/
[SECURITY] Fedora 39 Update: tomcat-9.0.89-1.fc39 - package-announce - Fedora Mailing-Lists
-
https://security.netapp.com/advisory/ntap-20240402-0002/
March 2024 Apache Tomcat Vulnerabilities in NetApp Products | NetApp Product Security
-
http://www.openwall.com/lists/oss-security/2024/03/13/3
oss-security - CVE-2024-24549: Apache Tomcat: HTTP/2 header handling DoS
-
https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
[SECURITY] CVE-2024-24549 Apache Tomcat - Denial of Service-Apache Mail Archives
Jump to