CVE-2024-52317
Fixed in a distro release EPSS 2%CVSS 6.5
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
Products: Apache Software Foundation Apache Tomcat, Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.96 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.1.31 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 11.0.0 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.96 |
| Maven | org.apache.tomcat:tomcat-coyote | 10.1.31 |
| Maven | org.apache.tomcat:tomcat-coyote | 11.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | tomcat10 | 10.1.31-1 |
| Debian 14 | tomcat10 | 10.1.31-1 |
| SUSE Enterprise Storage 7.1 | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP6 | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP6 | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | tomcat | 9.0.98-150200.74.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE Manager Server 4.3 | tomcat | 9.0.98-150200.74.1 |
| Ubuntu 25.10 | tomcat9 | no fix |
| Ubuntu 26.04 LTS | tomcat9 | no fix |
| Ubuntu Pro 24.04 LTS | tomcat10 | 10.1.16-1ubuntu0.1~esm3 |
| openSUSE Leap 15.6 | tomcat | 9.0.98-150200.74.1 |
| openSUSE Leap 15.6 | tomcat10 | 10.1.34-150200.5.31.1 |
| openSUSE Tumbleweed | tomcat | 9.0.102-1.1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.39-1.1 |