CVE catalog

CVE-2024-24549

Tomcat vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
23.07% · Oct 25, 2026

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantomcat9sid9.0.122-1fixed
Debiantomcat9forky9.0.122-1fixed
Debiantomcat9trixie9.0.95-1fixed
Debiantomcat9bookworm9.0.70-2fixed
Debiantomcat10sid10.1.60-1fixed
Debiantomcat10forky10.1.60-1fixed
Debiantomcat10trixie10.1.55-1~deb13u1fixed
Debiantomcat10trixie-security10.1.55-1~deb13u1fixed
Debiantomcat10bookworm10.1.55-1~deb12u1fixed
Debiantomcat10bookworm-security10.1.55-1~deb12u1fixed
Ubuntutomcat10noble10.1.16-1ubuntu0.1~esm2fixed
Ubuntutomcat9noble9.0.70-2ubuntu0.1+esm2fixed
Ubuntulibtomcat10-embed-javanoble10.1.16-1ubuntu0.1~esm2fixed
Ubuntulibtomcat10-javanoble10.1.16-1ubuntu0.1~esm2fixed
Ubuntulibtomcat9-javanoble9.0.70-2ubuntu0.1+esm2fixed
Ubuntutomcat10-adminnoble10.1.16-1ubuntu0.1~esm2fixed
Ubuntutomcat10-commonnoble10.1.16-1ubuntu0.1~esm2fixed
Ubuntutomcat10-docsnoble10.1.16-1ubuntu0.1~esm2fixed
Ubuntutomcat10-examplesnoble10.1.16-1ubuntu0.1~esm2fixed
Ubuntutomcat10-usernoble10.1.16-1ubuntu0.1~esm2fixed
Ubuntutomcat8pro8.5.21-1ubuntu1vulnerable
Ubuntutomcat8pro8.5.29-1vulnerable
Ubuntutomcat8pro8.5.30-1vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.2vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.3vulnerable
Ubuntutomcat8pro8.5.30-1ubuntu1.4vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.1vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.2vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm1vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm2vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm3vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm4vulnerable
Ubuntutomcat8pro8.5.39-1ubuntu1~18.04.3+esm5fixed
Ubuntutomcat9pro9.0.70-1ubuntu1vulnerable
Ubuntutomcat9pro9.0.70-2vulnerable
Ubuntutomcat9pro9.0.70-2ubuntu0.1vulnerable
Ubuntutomcat9pro9.0.70-2ubuntu0.1+esm1vulnerable
Ubuntutomcat9pro9.0.70-2ubuntu0.1+esm2fixed
Ubuntutomcat10pro10.1.10-1vulnerable
Ubuntutomcat10pro10.1.14-1vulnerable
Ubuntutomcat10pro10.1.15-1vulnerable
Ubuntutomcat10pro10.1.16-1vulnerable
Ubuntutomcat10pro10.1.16-1ubuntu0.1~esm1vulnerable
Ubuntutomcat10pro10.1.16-1ubuntu0.1~esm2fixed
Ubuntutomcat925.109.0.70-2ubuntu1.1vulnerable
Ubuntutomcat925.109.0.70-2ubuntu2vulnerable
Ubuntutomcat925.109.0.70-2ubuntu3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantomcat9sourcesid9.0.70-2not yet assignedNot reportedNot reported
Debiantomcat9sourceforky9.0.70-2not yet assignedNot reportedNot reported
Debiantomcat9sourcetrixie9.0.70-2not yet assignedNot reportedNot reported
Debiantomcat9sourcebookworm9.0.70-2not yet assignedNot reportedNot reported
Debiantomcat10sourcesid10.1.20-1not yet assignedNot reported[1066878]
Debiantomcat10sourceforky10.1.20-1not yet assignedNot reported[1066878]
Debiantomcat10sourcetrixie10.1.20-1not yet assignedNot reported[1066878]
Debiantomcat10sourcebookworm10.1.6-1+deb12u2not yet assignedNot reported[1066878]
Ubuntutomcat10debnoble10.1.16-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntutomcat9debnoble9.0.70-2ubuntu0.1+esm2Not reportedNot reportedNot reported
Ubuntulibtomcat10-embed-javadebnoble10.1.16-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntulibtomcat10-javadebnoble10.1.16-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntulibtomcat9-javadebnoble9.0.70-2ubuntu0.1+esm2Not reportedNot reportedNot reported
Ubuntutomcat10-admindebnoble10.1.16-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntutomcat10-commondebnoble10.1.16-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntutomcat10-docsdebnoble10.1.16-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntutomcat10-examplesdebnoble10.1.16-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntutomcat10-userdebnoble10.1.16-1ubuntu0.1~esm2Not reportedNot reportedNot reported
Ubuntutomcat8debpro8.5.39-1ubuntu1~18.04.3+esm5Not reportedUBUNTU-CVE-2024-24549Not reported
Ubuntutomcat9debpro9.0.70-2ubuntu0.1+esm2Not reportedUBUNTU-CVE-2024-24549Not reported
Ubuntutomcat10debpro10.1.16-1ubuntu0.1~esm2Not reportedUBUNTU-CVE-2024-24549Not reported
Ubuntutomcat9deb25.109.0.70-2ubuntu3Not reportedUBUNTU-CVE-2024-24549Not reported

[Debian bug #1066878]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]