Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Apache Tomcat

11.0.0-M1 - 11.0.0-M20

10.1.0-M1 - 10.1.24

9.0.0-M1 - 9.0.89

Source

security@apache.org

CVE-2024-34750 details

Published : July 3, 2024, 8:15 p.m.
Last Modified : July 3, 2024, 8:15 p.m.

Description

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

CVSS Score

1	2	3	4	5	6	7	8	9	10

Weakness

Weakness	Name	Description
CWE-400	Uncontrolled Resource Consumption	The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References

URL	Source
https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l	security@apache.org

This website uses the NVD API, but is not approved or certified by it.

CVE-2024-34750