Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests
could lead to request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.
Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs | Vendor Advisory Mailing List |
| http://www.openwall.com/lists/oss-security/2024/11/18/3 | Mailing List Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20250124-0004/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
15 May 2025, 17:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs - Vendor Advisory, Mailing List | |
| References | () http://www.openwall.com/lists/oss-security/2024/11/18/3 - Mailing List, Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20250124-0004/ - Third Party Advisory | |
| First Time |
Apache
Apache tomcat |
|
| CPE | cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:* |
24 Jan 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2024-11-18 12:15
Updated : 2025-05-15 17:51
NVD link : CVE-2024-52317
Mitre link : CVE-2024-52317
CVE.ORG link : CVE-2024-52317
JSON object : View
Products Affected
apache
- tomcat
CWE
CWE-326
Inadequate Encryption Strength