CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-38286 – Apache Tomcat: Denial of Service
https://notcve.org/view.php?id=CVE-2024-38286
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process. Vulnerabilidad de asignación de recursos sin límites o limitación de recursos en Apache Tomcat. Este problema afecta a Apache Tomcat: desde la versión 11.0.0-M1 hasta la 11.0.0-M20, desde la versión 10.1.0-M1 hasta la 10.1.24, desde la versión 9.0.13 hasta la 9.0.89. También pueden verse afectadas versiones anteriores no compatibles. • https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s https://access.redhat.com/security/cve/CVE-2024-38286 https://bugzilla.redhat.com/show_bug.cgi?id=2314686 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-34750 – Apache Tomcat: HTTP/2 excess header handling DoS
https://notcve.org/view.php?id=CVE-2024-34750
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue. Manejo inadecuado de condiciones excepcionales, vulnerabilidad de consumo incontrolado de recursos en Apache Tomcat. Al procesar una secuencia HTTP/2, Tomcat no manejó correctamente algunos casos de encabezados HTTP excesivos. • https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l https://access.redhat.com/security/cve/CVE-2024-34750 https://bugzilla.redhat.com/show_bug.cgi?id=2295651 • CWE-400: Uncontrolled Resource Consumption CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-23672 – Apache Tomcat: WebSocket DoS with incomplete closing handshake
https://notcve.org/view.php?id=CVE-2024-23672
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. Denegación de servicio mediante vulnerabilidad de limpieza incompleta en Apache Tomcat. Los clientes de WebSocket podían mantener abiertas las conexiones de WebSocket, lo que generaba un mayor consumo de recursos. Este problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.0-M16, desde 10.1.0-M1 hasta 10.1.18, desde 9.0. 0-M1 hasta 9.0.85, desde 8.5.0 hasta 8.5.98. • http://www.openwall.com/lists/oss-security/2024/03/13/4 https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55 https://security.netapp.com/advisory/ntap-20240402-0002 https://access.redhat.com/security/c • CWE-459: Incomplete Cleanup •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 2CVE-2024-24549 – Apache Tomcat: HTTP/2 header handling DoS
https://notcve.org/view.php?id=CVE-2024-24549
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. Denegación de servicio debido a una vulnerabilidad de validación de entrada incorrecta para solicitudes HTTP/2 en Apache Tomcat. Al procesar una solicitud HTTP/2, si la solicitud excedía cualquiera de los límites configurados para los encabezados, la secuencia HTTP/2 asociada no se restablecía hasta que se hubieran procesado todos los encabezados. Este problema afecta a Apache Tomcat: desde 11.0.0- M1 hasta 11.0.0-M16, desde 10.1.0-M1 hasta 10.1.18, desde 9.0.0-M1 hasta 9.0.85, desde 8.5.0 hasta 8.5.98. • https://github.com/Abdurahmon3236/CVE-2024-24549 https://github.com/JFOZ1010/CVE-2024-24549 http://www.openwall.com/lists/oss-security/2024/03/13/3 https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55& • CWE-20: Improper Input Validation •