CVE-2024-23672

NameCVE-2024-23672
DescriptionDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3779-1, DSA-5665-1, DSA-5667-1
Debian Bugs1066877

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tomcat10 (PTS)bookworm, bookworm (security)10.1.6-1+deb12u2fixed
sid, trixie10.1.30-1fixed
tomcat9 (PTS)bullseye (security), bullseye9.0.43-2~deb11u10fixed
trixie, bookworm9.0.70-2fixed
sid9.0.95-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tomcat10sourcebookworm10.1.6-1+deb12u2DSA-5665-1
tomcat10source(unstable)10.1.20-11066877
tomcat9sourcebuster9.0.31-1~deb10u12DLA-3779-1
tomcat9sourcebullseye9.0.43-2~deb11u10DSA-5667-1
tomcat9source(unstable)9.0.70-2

Notes

https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f
https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501 (10.1.19)
https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068 (9.0.86)
Starting with 9.0.70-2 Tomcat9 no longer ships the server stack, using that as the fixed version

Search for package or bug name: Reporting problems