cve.bz

CVE-2024-52317

6.5 mediumEPSS 2.1%

Medium (6.5) in apache tomcat. EPSS 2.1% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat.embed:tomcat-embed-core 10.1.31, 11.0.0, 9.0.96.

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE
CWE-326
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-qvf5-hvjx-wm27Mavenorg.apache.tomcat.embed:tomcat-embed-core>=9.0.92 <9.0.969.0.96
GHSA-qvf5-hvjx-wm27Mavenorg.apache.tomcat:tomcat-coyote>=9.0.92 <9.0.969.0.96
GHSA-qvf5-hvjx-wm27Mavenorg.apache.tomcat.embed:tomcat-embed-core>=10.1.27 <10.1.3110.1.31
GHSA-qvf5-hvjx-wm27Mavenorg.apache.tomcat.embed:tomcat-embed-core>=11.0.0-M23 <11.0.011.0.0
GHSA-qvf5-hvjx-wm27Mavenorg.apache.tomcat:tomcat-coyote>=10.1.27 <10.1.3110.1.31
GHSA-qvf5-hvjx-wm27Mavenorg.apache.tomcat:tomcat-coyote>=11.0.0-M23 <11.0.011.0.0

References

Check your stackJSON