CVE-2024-23672

Aliases:GHSA-v682-8vv8-vpwrBIT-tomcat-2024-23672
Advisory lineage Upstream: 0 Downstream: 20
Modified
Published: 13 Mar 2024, 15:48
Last modified:29 Oct 2025, 11:57

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.3 MEDIUM
v3.1 (cve.org)
EPSS Score
1.44% LOW
1% probability +0.86%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Mar 2024, 15:48
Published
Vulnerability first disclosed
29 Oct 2025, 11:57
Last Modified
Vulnerability information updated

Description

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Trends

Current EPSS score: 1.44%• Percentile: 81%

Techniques & Countermeasures

  • CWE-459•Incomplete Cleanup

    The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Affected Systems

  • apache software foundation•apache tomcat

    ≥ 11.0.0-M1, ≤ 11.0.0-M16 | ≥ 10.1.0-M1, ≤ 10.1.18 | ≥ 9.0.0-M1, ≤ 9.0.85 | ≥ 8.5.0, ≤ 8.5.98

  • Unknown•Tomcat

    ≥ 8.5.0, < 8.5.99 | ≥ 9.0.0, < 9.0.86 | ≥ 10.1.0, < 10.1.19 | 11.0.0:milestone1 | 11.0.0:milestone10 | 11.0.0:milestone11 | 11.0.0:milestone12 | 11.0.0:milestone13 | 11.0.0:milestone14 | 11.0.0:milestone15 | 11.0.0:milestone16 | 11.0.0:milestone2 | 11.0.0:milestone3 | 11.0.0:milestone4 | 11.0.0:milestone5 | 11.0.0:milestone6 | 11.0.0:milestone7 | 11.0.0:milestone8 | 11.0.0:milestone9

  • debian•debian_linux

    10.0

  • fedoraproject•fedora

    39 | 40

  • org.apache.tomcat•tomcat-websocket

    ≥ 11.0.0-M1, < 11.0.0-M17 | ≥ 10.1.0-M1, < 10.1.19 | ≥ 9.0.0-M1, < 9.0.86 | ≥ 8.5.0, < 8.5.99

  • org.apache.tomcat.embed•tomcat-embed-websocket

    ≥ 11.0.0-M1, < 11.0.0-M17 | ≥ 10.1.0-M1, < 10.1.19 | ≥ 9.0.0-M1, < 9.0.86 | ≥ 8.5.0, < 8.5.99

References (15)