VYPR
← All advisories
High severity8.6NVD Advisory· Published Nov 7, 2024· Updated Jun 17, 2026

CVE-2024-38286

CVE-2024-38286

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.

Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcat-coyoteMaven
>= 11.0.0-M1, < 11.0.0-M2111.0.0-M21
org.apache.tomcat:tomcat-coyoteMaven
>= 10.1.0-M1, < 10.1.2510.1.25
org.apache.tomcat:tomcat-coyoteMaven
>= 9.0.13, < 9.0.909.0.90
org.apache.tomcat:tomcat-coyoteMaven
>= 8.5.35, <= 8.5.100—
org.apache.tomcat:tomcat-coyoteMaven
>= 7.0.92, <= 7.0.109—
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 11.0.0-M1, < 11.0.0-M2111.0.0-M21
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 10.1.0-M1, < 10.1.2510.1.25
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 9.0.13, < 9.0.909.0.90
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 8.5.35, <= 8.5.100—
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 7.0.92, <= 7.0.109—

Affected products

54
  • osv-coords10 versions
    pkg:apk/chainguard/tomcat-9-openjdk-17pkg:apk/chainguard/tomcat-9-openjdk-8pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:maven/org.apache.tomcat/tomcat-utilpkg:bitnami/tomcatpkg:apk/chainguard/tomcat-9-openjdk-11pkg:apk/chainguard/tomcat-9-openjdk-21pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
    < 9.0.112-r0+ 9 more
    • (no CPE)range: < 9.0.112-r0
    • (no CPE)range: < 9.0.112-r0
    • (no CPE)range: < 9.0.36-3.130.1
    • (no CPE)range: >= 11.0.0-M1, < 11.0.0-M21
    • (no CPE)range: >= 9.0.13, < 9.0.90
    • (no CPE)range: < 9.0.112-r0
    • (no CPE)range: < 9.0.112-r0
    • (no CPE)range: < 9.0.36-3.130.1
    • (no CPE)range: < 9.0.115-3.160.1
    • (no CPE)range: < 9.0.115-3.160.1
  • Apache Software Foundation/Apache Tomcatv5
    Range: 11.0.0-M1
  • Apache/Tomcat41 versions
    cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*+ 40 more
    • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*range: >=9.0.13,<9.0.90
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*
  • NetApp/Ontap Tools2 versions
    cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*+ 1 more
    • cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*
    • cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*

Patches

Vulnerability mechanics

References

10

News mentions

0

No linked articles in our index yet.