CVE-2024-38286

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.

Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

Root has patched CVE-2024-38286 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.24, from 9.0.13 through 9.0.89.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0, 10.1.25, or 9.0.90, which fixes the issue.

Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

CVE-2024-38286: fix DoS vulnerability in TLS handshake process

TuxCare rebuilt 3 packages to address 10 CVEs. Fixed in 8.5.100.tuxcare.1.

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.

TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.50-tuxcare.1.

• CVE-2024-50379: fix TOCTOU vulnerability in JSP compilation to prevent RCE on case insensitive file systems
• CVE-2024-38286: fix issue of resource allocation without limits or throttling vulnerability in TLS handshake process
• Apply skip-common-daemon patch to remove the commons-daemon.jar copy in build.xml, as Alma/RHEL cannot ship bundled JARs and must use the system commons-daemon The ELS-provided source archive requires this adaptation

TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.

TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.

TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.

• SECURITY UPDATE: Denial of Service caused by unbounded TLS handshake wrap queue in SecureNio2Channel / SecureNioChannel. Backport upstream fix from 9.0.x commit 76c5cce6f0bcef14b0c21c38910371ca7d322d13.
  • debian/patches/CVE-2024-38286.patch: cap the handshake wrap queue at HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT (100) and close the connection with a localised error message if the cap is exceeded, covering both Nio2 and Nio connector variants. Also includes upstream follow-up bfa5de95ad ("Avoid possible lost update") which converts the SecureNio2Channel counter to AtomicInteger and resets it in reset() to prevent a non-atomic read-modify-write race.
  • CVE-2024-38286

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

TuxCare rebuilt 5 packages to address 15 CVEs. Fixed in 10.1.16-tuxcare.1.

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 8.5.78-tuxcare.2.

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

This update for tomcat fixes the following issues:

• CVE-2024-38286: OutOfMemory exception triggered through abuse of the TLS handshake process. (bsc#1230986)

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.115:

• CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
• CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
• CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
• CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
• CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
• CVE-2023-44487: Rapid reset attack (bsc#1216182).

It was discovered that Tomcat did not include the secure attribute for session cookies when using the RemoteIpFilter with requests from a reverse proxy. An attacker could possibly use this issue to leak sensitive information. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2023-28708)

It was discovered that Tomcat incorrectly recycled certain objects, which could lead to information leaking from one request to the next. An attacker could potentially use this issue to leak sensitive information. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2023-42795)

It was discovered that Tomcat incorrectly handled HTTP trailer headers. A remote attacker could possibly use this issue to perform HTTP request smuggling. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2023-45648)

It was discovered that Tomcat incorrectly handled incomplete POST requests, which could cause error responses to contain data from previous requests. An attacker could potentially use this issue to leak sensitive information. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for tomcat9 on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2024-21733)

It was discovered that Tomcat incorrectly handled socket cleanup, which could lead to websocket connections staying open. An attacker could possibly use this issue to cause a denial of service. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS, tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04, and for tomcat10 on Ubuntu 24.04 LTS. (CVE-2024-23672)

It was discovered that Tomcat incorrectly handled HTTP/2 requests that exceeded configured header limits. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-24549)

It was discovered that Tomcat incorrectly handled some cases of excessive HTTP headers when processing HTTP/2 streams. This led to miscounting of active streams and incorrect timeout handling. An attacker could possibly use this issue to cause connections to remain open indefinitely, leading to a denial of service. This issue was fixed for tomcat9 on Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04, and for tomcat10 on Ubuntu 24.04 LTS. (CVE-2024-34750)

It was discovered that Tomcat incorrectly handled TLS handshake processes under certain configurations. An attacker could possibly use this issue to cause a denial of service. This issue was fixed for tomcat9 on Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04, and for tomcat10 on Ubuntu 24.04 LTS. (CVE-2024-38286)