CVE-2024-38286 Apache Tomcat: Denial of Service
An attacker can cause a denial of service via OutOfMemoryError by abusing the TLS handshake process in Apache Tomcat under certain configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38286?
CVE-2024-38286 is a high-severity denial of service vulnerability in Apache Tomcat, published on 7 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.
The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.
Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
Weakness: CWE-770
Which versions are affected by CVE-2024-38286?
21 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-coyote. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.25 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.25 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.0-M21 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.0-M21 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.92 to 7.0.109 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.92 to 7.0.109 | None |
15 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.35 to 8.5.100 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.35 to 8.5.100 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.13 | 9.0.90 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.13 | 9.0.90 |
tomcat Bitnami | From 9.0.13 | 9.0.90, 10.1.25, 11.0.9 |
org.apache.tomcat:tomcat-coyote Maven | From 10.1.0-M1 | 10.1.25 |
org.apache.tomcat:tomcat-coyote Maven | From 10.1.0-M1 | 10.1.25 |
org.apache.tomcat:tomcat-coyote Maven | From 11.0.0-M1 | 11.0.0-M21 |
org.apache.tomcat:tomcat-coyote Maven | From 11.0.0-M1 | 11.0.0-M21 |
org.apache.tomcat:tomcat-coyote Maven | From 7.0.92 to 7.0.109 | None |
org.apache.tomcat:tomcat-coyote Maven | From 7.0.92 to 7.0.109 | None |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.35 to 8.5.100 | None |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.35 to 8.5.100 | None |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.13 | 9.0.90 |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.13 | 9.0.90 |
Linux distribution packages (19)
apache-commons-collections Red Hat:rhel_aus:8.2::appstream | All versions | 0:3.2.2-10.module+el8.1.0+3366+6dfb954c |
apache-commons-lang Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.6-21.module+el8.1.0+3366+6dfb954c |
bea-stax Red Hat:rhel_aus:8.2::appstream | All versions | 0:1.2.0-16.module+el8.1.0+3366+6dfb954c |
bea-stax-api Red Hat:rhel_aus:8.2::appstream | All versions | 0:1.2.0-16.module+el8.1.0+3366+6dfb954c |
glassfish-fastinfoset Red Hat:rhel_aus:8.2::appstream | All versions | 0:1.2.13-9.module+el8.1.0+3366+6dfb954c |
glassfish-jaxb Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c |
glassfish-jaxb-api Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.2.12-8.module+el8.1.0+3366+6dfb954c |
glassfish-jaxb-core Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c |
glassfish-jaxb-runtime Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c |
glassfish-jaxb-txw2 Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c |
jackson-annotations Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 |
jackson-core Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 |
jackson-databind Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 |
jackson-jaxrs-json-provider Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.9.9-1.module+el8.1.0+3832+9784644d |
jackson-jaxrs-providers Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.9.9-1.module+el8.1.0+3832+9784644d |
jackson-module-jaxb-annotations Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.7.6-4.module+el8.1.0+3366+6dfb954c |
jakarta-commons-httpclient Red Hat:rhel_aus:8.2::appstream | All versions | 1:3.1-28.module+el8.1.0+3366+6dfb954c |
javassist Red Hat:rhel_aus:8.2::appstream | All versions | 0:3.18.1-8.module+el8.1.0+3366+6dfb954c |
javassist-javadoc Red Hat:rhel_aus:8.2::appstream | All versions | 0:3.18.1-8.module+el8.1.0+3366+6dfb954c |
Products include Apache Tomcat, Netapp Ontap Tools.
How do I fix CVE-2024-38286?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.25, 11.0.0-M21 or 9.0.90.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-38286 being exploited?
There is no known exploitation of CVE-2024-38286 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2024-38286, CLSA-2025-1737654382, CLSA-2026-1777305243, DEBIAN-CVE-2024-38286, GHSA-7jqf-v358-p8g7, RHSA-2024:8494 and 8 more.