6.3

CVE-2024-23672

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.

Older, EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 8.5.0 < 8.5.99
Apache ≫ Tomcat Version >= 9.0.0 < 9.0.86
Apache ≫ Tomcat Version >= 10.1.0 < 10.1.19
Apache ≫ Tomcat Version11.0.0 Updatemilestone1
Apache ≫ Tomcat Version11.0.0 Updatemilestone10
Apache ≫ Tomcat Version11.0.0 Updatemilestone11
Apache ≫ Tomcat Version11.0.0 Updatemilestone12
Apache ≫ Tomcat Version11.0.0 Updatemilestone13
Apache ≫ Tomcat Version11.0.0 Updatemilestone14
Apache ≫ Tomcat Version11.0.0 Updatemilestone15
Apache ≫ Tomcat Version11.0.0 Updatemilestone16
Apache ≫ Tomcat Version11.0.0 Updatemilestone2
Apache ≫ Tomcat Version11.0.0 Updatemilestone3
Apache ≫ Tomcat Version11.0.0 Updatemilestone4
Apache ≫ Tomcat Version11.0.0 Updatemilestone5
Apache ≫ Tomcat Version11.0.0 Updatemilestone6
Apache ≫ Tomcat Version11.0.0 Updatemilestone7
Apache ≫ Tomcat Version11.0.0 Updatemilestone8
Apache ≫ Tomcat Version11.0.0 Updatemilestone9
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version39
Fedoraproject ≫ Fedora Version40
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.678
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-459 Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.