7.5

CVE-2024-24549

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.

Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 8.5.0 < 8.5.99
Apache ≫ Tomcat Version >= 9.0.0 < 9.0.86
Apache ≫ Tomcat Version >= 10.1.0 < 10.1.19
Apache ≫ Tomcat Version11.0.0 Updatemilestone1
Apache ≫ Tomcat Version11.0.0 Updatemilestone10
Apache ≫ Tomcat Version11.0.0 Updatemilestone11
Apache ≫ Tomcat Version11.0.0 Updatemilestone12
Apache ≫ Tomcat Version11.0.0 Updatemilestone13
Apache ≫ Tomcat Version11.0.0 Updatemilestone14
Apache ≫ Tomcat Version11.0.0 Updatemilestone15
Apache ≫ Tomcat Version11.0.0 Updatemilestone16
Apache ≫ Tomcat Version11.0.0 Updatemilestone2
Apache ≫ Tomcat Version11.0.0 Updatemilestone3
Apache ≫ Tomcat Version11.0.0 Updatemilestone4
Apache ≫ Tomcat Version11.0.0 Updatemilestone5
Apache ≫ Tomcat Version11.0.0 Updatemilestone6
Apache ≫ Tomcat Version11.0.0 Updatemilestone7
Apache ≫ Tomcat Version11.0.0 Updatemilestone8
Apache ≫ Tomcat Version11.0.0 Updatemilestone9
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version39
Fedoraproject ≫ Fedora Version40
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 52.45% 0.978
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.