CVE-2024-54677
Fixed in a distro release EPSS 2%CVSS 5.3
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat | 11.0.2 |
| Maven | org.apache.tomcat:tomcat | 10.1.34 |
| Maven | org.apache.tomcat:tomcat | 9.0.98 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:10 | tomcat | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-admin-webapps | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-docs-webapp | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-el-5.0-api | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-jsp-3.1-api | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-lib | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-servlet-6.0-api | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-webapps | 1:10.1.36-1.el10_0 |
| Debian:11 | tomcat9 | 9.0.107-0+deb11u1 |
| Debian:12 | tomcat10 | 10.1.34-0+deb12u1 |
| Debian:12 | tomcat9 | 9.0.70-2 |
| Debian:13 | tomcat10 | 10.1.34-1 |
| Debian:13 | tomcat9 | 9.0.70-2 |
| Debian:14 | tomcat10 | 10.1.34-1 |
| Debian:14 | tomcat9 | 9.0.70-2 |
| Red Hat:enterprise_linux:10.0 | tomcat | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-admin-webapps | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-docs-webapp | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-el-5.0-api | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-jsp-3.1-api | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-lib | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-servlet-6.0-api | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-webapps | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:8 | tomcat | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-admin-webapps | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-docs-webapp | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-el-3.0-api | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-jsp-2.3-api | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-lib | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-servlet-4.0-api | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-webapps | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:9 | tomcat | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-admin-webapps | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-docs-webapp | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-el-3.0-api | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-jsp-2.3-api | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-lib | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-servlet-4.0-api | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-webapps | 1:9.0.110-2.el9_8 |
| Red Hat:rhel_e4s:8.8 | tomcat | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-admin-webapps | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-docs-webapp | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-el-3.0-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-jsp-2.3-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-lib | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-servlet-4.0-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-webapps | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:9.2 | tomcat | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-admin-webapps | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-docs-webapp | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-el-3.0-api | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-jsp-2.3-api | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-lib | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-servlet-4.0-api | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-webapps | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.4 | tomcat | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-admin-webapps | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-docs-webapp | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-el-3.0-api | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-jsp-2.3-api | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-lib | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-servlet-4.0-api | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-webapps | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_eus:9.6 | tomcat | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-admin-webapps | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-docs-webapp | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-el-3.0-api | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-jsp-2.3-api | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-lib | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-servlet-4.0-api | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-webapps | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_tus:8.8 | tomcat | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-admin-webapps | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-docs-webapp | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-el-3.0-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-jsp-2.3-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-lib | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-servlet-4.0-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-webapps | 1:9.0.120-1.el8_8 |
| Rocky Linux:10 | tomcat | 1:10.1.36-1.el10_0 |
| SUSE:Enterprise Storage 7.1 | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP6 | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP6 | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.36-3.136.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.115-3.160.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.36-3.136.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.115-3.160.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | tomcat | 9.0.98-150200.74.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | tomcat10 | 10.1.34-150200.5.31.1 |
| SUSE:Manager Server 4.3 | tomcat | 9.0.98-150200.74.1 |
| Ubuntu:Pro:16.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:20.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:22.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:24.04:LTS | tomcat10 | 10.1.16-1ubuntu0.1~esm3 |
| openSUSE:Leap 15.6 | tomcat | 9.0.98-150200.74.1 |
| openSUSE:Leap 15.6 | tomcat10 | 10.1.34-150200.5.31.1 |
| openSUSE:Tumbleweed | tomcat | 9.0.98-1.1 |
| openSUSE:Tumbleweed | tomcat10 | 10.1.34-1.1 |