CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2024-54677
Medium (5.3). EPSS 1.9% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat 10.1.34, 11.0.2, 9.0.98.
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
- netapp:bootstrap_os
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-653p-vg55-5652 | Maven | org.apache.tomcat:tomcat | >=11.0.0-M1 <11.0.2 | 11.0.2 |
| GHSA-653p-vg55-5652 | Maven | org.apache.tomcat:tomcat | >=10.1.0-M1 <10.1.34 | 10.1.34 |
| GHSA-653p-vg55-5652 | Maven | org.apache.tomcat:tomcat | >=9.0.0.M1 <9.0.98 | 9.0.98 |