CVE-2024-38286: Apache Tomcat: Denial of Service

Modified

AliasesSUSE-SU-2024:3510-1RHSA-2024:8494RHSA-2024:8497+12 more

Published 07-11-2024Last modified 03-11-2025

Vulnerability summary

CVE-2024-38286 is a high (CVSS 8.6) vulnerability in apache software foundation apache tomcat. EPSS estimates a 1.69% chance of exploitation in the next 30 days, higher than 77% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 8.6 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.6/10

010

High · v3.1 (CVE.org)

EPSS score

1.69%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 3

DLA-4017-1 DSA-5845-1 RHSA-2024:4976 RHSA-2024:5024 RHSA-2024:5693 RHSA-2024:5694+7 more

Timeline

07-11-2024
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

CVSS metrics

8 scores · 7 sources · 2 versions

v4.07.7v3.18.6

EPSS trend

Probability

1.69%

Chance of exploitation in the next 30 days

Percentile

77%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.69% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat60 products

apache-commons-collections< 0:3.2.2-10.module+el8.1.0+3366+6dfb954c
apache-commons-lang< 0:2.6-21.module+el8.1.0+3366+6dfb954c
apache-commons-net< 0:3.6-3.module+el8.3.0+6805+72837426
bea-stax< 0:1.2.0-16.module+el8.1.0+3366+6dfb954c
bea-stax-api< 0:1.2.0-16.module+el8.1.0+3366+6dfb954c

glassfish-fastinfoset< 0:1.2.13-9.module+el8.1.0+3366+6dfb954c
glassfish-jaxb< 0:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-api< 0:2.2.12-8.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-core< 0:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-runtime< 0:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-txw2< 0:2.2.11-11.module+el8.1.0+3366+6dfb954c
idm-pki-acme< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-base< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-base-java< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-ca< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-kra< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-server< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-symkey< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-symkey-debuginfo< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-tools< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
idm-pki-tools-debuginfo< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
jackson-annotations< 0:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-core< 0:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-databind< 0:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-jaxrs-json-provider< 0:2.9.9-1.module+el8.1.0+3832+9784644d
jackson-jaxrs-providers< 0:2.9.9-1.module+el8.1.0+3832+9784644d
jackson-module-jaxb-annotations< 0:2.7.6-4.module+el8.1.0+3366+6dfb954c
jakarta-commons-httpclient< 1:3.1-28.module+el8.1.0+3366+6dfb954c
javassist< 0:3.18.1-8.module+el8.1.0+3366+6dfb954c
javassist-javadoc< 0:3.18.1-8.module+el8.1.0+3366+6dfb954c
jss< 0:4.9.4-1.module+el8.7.0+15532+95bac9ee
jss-debuginfo< 0:4.9.4-1.module+el8.7.0+15532+95bac9ee
jss-debugsource< 0:4.9.4-1.module+el8.7.0+15532+95bac9ee
jss-javadoc< 0:4.9.4-1.module+el8.7.0+15532+95bac9ee
ldapjdk< 0:4.23.0-1.module+el8.5.0+11983+6ba118b4
ldapjdk-javadoc< 0:4.23.0-1.module+el8.5.0+11983+6ba118b4
pki-core< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
pki-core-debuginfo< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
pki-core-debugsource< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
pki-servlet-4.0-api< 1:9.0.50-1.el9_2.1 | < 1:9.0.30-1.module+el8.4.0+22383+8a8bb077.1 | < 1:9.0.43-4.el9_0.1 | < 1:9.0.7-16.module+el8.2.0+22384+93cade87.1 | < 1:9.0.30-3.module+el8.6.0+22385+e922a50e.1
pki-servlet-engine< 1:9.0.50-1.el9_2.1 | < 1:9.0.30-1.module+el8.4.0+22383+8a8bb077.1 | < 1:9.0.43-4.el9_0.1 | < 1:9.0.62-1.module+el8.8.0+22367+4894538d | < 1:9.0.7-16.module+el8.2.0+22384+93cade87.1 | < 1:9.0.30-3.module+el8.6.0+22385+e922a50e.1
python-nss< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python-nss-debugsource< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python-nss-doc< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-idm-pki< 0:10.14.3-3.module+el8.8.0+22366+77f9de5e
python3-nss< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-nss-debuginfo< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
relaxngDatatype< 0:2011.1-7.module+el8.1.0+3366+6dfb954c
resteasy< 0:3.0.26-6.module+el8.4.0+8891+bb8828ef | < 0:3.0.26-7.module+el8.8.0+22365+b433a336 | < 0:3.0.26-3.module+el8.2.0+5723+4574fbff
slf4j< 0:1.7.25-4.module+el8.1.0+3366+6dfb954c
slf4j-jdk14< 0:1.7.25-4.module+el8.1.0+3366+6dfb954c
stax-ex< 0:1.7.7-8.module+el8.2.0+5723+4574fbff
tomcatjss< 0:7.7.1-2.module+el8.8.0+22366+77f9de5e
velocity< 0:1.7-24.module+el8.1.0+3366+6dfb954c
xalan-j2< 0:2.7.1-38.module+el8.1.0+3366+6dfb954c
xerces-j2< 0:2.11.0-34.module+el8.1.0+3366+6dfb954c
xml-commons-apis< 0:1.4.01-25.module+el8.1.0+3366+6dfb954c
xml-commons-resolver< 0:1.2-26.module+el8.1.0+3366+6dfb954c
xmlstreambuffer< 0:1.5.4-8.module+el8.2.0+5723+4574fbff
xsom< 0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c

Show all 60

Ubuntu3 products

tomcat10< 10.1.16-1ubuntu0.1~esm2
tomcat8All versions (No fix recorded)
tomcat9< 9.0.16-3ubuntu0.18.04.2+esm7 | < 9.0.31-1ubuntu0.9+esm2 | < 9.0.58-1ubuntu0.2+esm3 | < 9.0.70-2ubuntu0.1+esm2 | < 9.0.70-2ubuntu3

Debian2 products

tomcat10< 10.1.34-0+deb12u1 | < 10.1.25-1
tomcat9< 9.0.70-2

Suse2 products

tomcat&distro=SUSE Linux Enterprise Server 12 SP5< 9.0.36-3.130.1
tomcat&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 9.0.36-3.130.1

Apache1 product

tomcat≥ 9.0.13, < 9.0.90 | ≥ 10.1.1, < 10.1.25 | 10.1.0:milestone1 | 10.1.0:milestone10 | 10.1.0:milestone11 | 10.1.0:milestone12 | 10.1.0:milestone13 | 10.1.0:milestone14 | 10.1.0:milestone15 | 10.1.0:milestone16 | 10.1.0:milestone17 | 10.1.0:milestone18 | 10.1.0:milestone19 | 10.1.0:milestone2 | 10.1.0:milestone20 | 10.1.0:milestone3 | 10.1.0:milestone4 | 10.1.0:milestone5 | 10.1.0:milestone6 | 10.1.0:milestone7 | 10.1.0:milestone8 | 10.1.0:milestone9 | 11.0.0:milestone1 | 11.0.0:milestone10 | 11.0.0:milestone11 | 11.0.0:milestone12 | 11.0.0:milestone13 | 11.0.0:milestone14 | 11.0.0:milestone15 | 11.0.0:milestone16 | 11.0.0:milestone17 | 11.0.0:milestone18 | 11.0.0:milestone19 | 11.0.0:milestone2 | 11.0.0:milestone20 | 11.0.0:milestone3 | 11.0.0:milestone4 | 11.0.0:milestone5 | 11.0.0:milestone6 | 11.0.0:milestone7 | 11.0.0:milestone8 | 11.0.0:milestone9

Apache software foundation1 product

apache tomcat≥ 11.0.0-M1, ≤ 11.0.0-M20 | ≥ 10.1.0-M1, ≤ 10.1.24 | ≥ 9.0.13, ≤ 9.0.89 | ≥ 8.5.35, ≤ 8.5.100 | ≥ 7.0.92, ≤ 7.0.109

Chainguard1 product

tomcat-8.5.87All versions (No fix recorded) | < 8.5.87-r6

Netapp1 product

ontap_tools9 | 10

Org.apache.tomcat1 product

tomcat-coyote≥ 11.0.0-M1, < 11.0.0-M21 | ≥ 10.1.0-M1, < 10.1.25 | ≥ 9.0.13, < 9.0.90 | ≥ 8.5.35, ≤ 8.5.100 | ≥ 7.0.92, ≤ 7.0.109

Org.apache.tomcat.embed1 product

tomcat-embed-core≥ 11.0.0-M1, < 11.0.0-M21 | ≥ 10.1.0-M1, < 10.1.25 | ≥ 9.0.13, < 9.0.90 | ≥ 8.5.35, ≤ 8.5.100 | ≥ 7.0.92, ≤ 7.0.109

10 vendors · 73 products

References

33 links

lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4sVendor AdvisoryARTICLEREPORTAdvisoryWEBMailing List
www.openwall.com/lists/oss-security/2024/09/23/2WEBMailing List
security.netapp.com/advisory/ntap-20241101-0010/AdvisoryThird Party Advisory
lists.debian.org/debian-lts-announce/2025/01/msg00009.htmlWEB
www.suse.com/support/update/announcement/2024/suse-su-20243510-1/Advisory
bugzilla.suse.com/1230986REPORT
www.suse.com/security/cve/CVE-2024-38286WEB
access.redhat.com/errata/RHSA-2024:8494Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2314686REPORT

Show all 33 references