CVE-2024-52317

Description

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

How to fix CVE-2024-52317

To remediate CVE-2024-52317, upgrade the affected package to a fixed version below.

• —upgrade to 9.0.96 or later
• —upgrade to 10.1.31-1 or later
• —upgrade to 9.0.96 or later
• —upgrade to 9.0.96 or later

Is CVE-2024-52317 being exploited?

Moderate — EPSS is 21.5%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (4)

• >= 9.0.92, < 9.0.96, >= 10.1.27, < 10.1.31, >= 11.0.0, < 11.0.9
• from 0, < 10.1.31-1
• >= 9.0.92, < 9.0.96
• >= 9.0.92, < 9.0.96

CVSS scores

References (10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-52317
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2024-52317
• PATCHgithub.com/apache/tomcat
• WEBgithub.com/apache/tomcat/commit/146f94f87ea398fb592c7a20a5ccbef95e9dd72b