~ / search / GHSA-wm9w-rjj3-j356

GHSA-wm9w-rjj3-j356

Apache Tomcat - Denial of Service

Source: GitHub Advisory Database (reviewed) High CVE-2024-34750

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.0-M21 11.0.0-M21
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.25 10.1.25
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M1, < 9.0.90 9.0.90
Maven org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.0-M21 11.0.0-M21
Maven org.apache.tomcat:tomcat-coyote >= 10.1.0-M1, < 10.1.25 10.1.25
Maven org.apache.tomcat:tomcat-coyote >= 9.0.0-M1, < 9.0.90 9.0.90
Maven org.apache.tomcat:tomcat-coyote >= 8.5.0, <= 8.5.100 no fix listed
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.