CVE-2024-52318
Fixed in a distro release EPSS 2%CVSS 6.1
Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 9.0.97 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 11.0.1 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 10.1.32 |
| Maven | org.apache.tomcat:tomcat | 11.0.1 |
| Maven | org.apache.tomcat:tomcat | 10.1.32 |
| Maven | org.apache.tomcat:tomcat | 9.0.97 |
| Maven | org.apache.tomcat:tomcat-jasper | 11.0.1 |
| Maven | org.apache.tomcat:tomcat-jasper | 10.1.32 |
| Maven | org.apache.tomcat:tomcat-jasper | 9.0.97 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:13 | tomcat10 | 10.1.33-1 |
| Debian:14 | tomcat10 | 10.1.33-1 |
| Ubuntu:22.04:LTS | tomcat9 | no fix |
| Ubuntu:24.04:LTS | tomcat10 | no fix |
| Ubuntu:24.04:LTS | tomcat9 | no fix |
| Ubuntu:25.04 | tomcat9 | no fix |
| Ubuntu:Pro:14.04:LTS | tomcat6 | no fix |
| Ubuntu:Pro:14.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat6 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:20.04:LTS | tomcat9 | no fix |