Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.
Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
19 May 2025, 13:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:* |
|
| References | () http://www.openwall.com/lists/oss-security/2024/03/13/4 - Mailing List | |
| References | () https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f - Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/ - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/ - Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20240402-0002/ - Third Party Advisory | |
| First Time |
Fedoraproject
Apache Fedoraproject fedora Debian Debian debian Linux Apache tomcat |
13 Feb 2025, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. |
Information
Published : 2024-03-13 16:15
Updated : 2025-05-19 13:00
NVD link : CVE-2024-23672
Mitre link : CVE-2024-23672
CVE.ORG link : CVE-2024-23672
JSON object : View
Products Affected
fedoraproject
- fedora
apache
- tomcat
debian
- debian_linux
CWE
CWE-459
Incomplete Cleanup