CVE-2024-50379 Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
Attackers can achieve remote code execution via a race condition in JSP compilation on case-insensitive file systems when the default servlet write is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50379?
CVE-2024-50379 is a critical vulnerability in Apache Tomcat, published on 17 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Weakness: CWE-367
Which versions are affected by CVE-2024-50379?
17 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-catalina. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.34 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.34 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.2 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.2 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 to 8.5.100 | None |
11 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0.M1 | 9.0.98 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0.M1 | 9.0.98 |
tomcat Bitnami | From 9.0.0 | 9.0.98, 10.1.34, 11.0.2 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.34 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.34 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M1 | 11.0.2 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M1 | 11.0.2 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0.M1 | 9.0.98 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0.M1 | 9.0.98 |
Linux distribution packages (23)
jws5-tomcat Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-admin-webapps Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-docs-webapp Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-el-3.0-api Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-java-jdk11 Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-java-jdk8 Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-javadoc Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-jsp-2.3-api Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-lib Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-selinux Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-servlet-4.0-api Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat-webapps Red Hat:jboss_enterprise_web_server:5.8::el7 | All versions | 0:9.0.87-6.redhat_00006.1.el7jws |
jws5-tomcat Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-admin-webapps Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-docs-webapp Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-el-3.0-api Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-javadoc Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-jsp-2.3-api Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-lib Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-selinux Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-servlet-4.0-api Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat-webapps Red Hat:jboss_enterprise_web_server:5.8::el8 | All versions | 0:9.0.87-6.redhat_00006.1.el8jws |
jws5-tomcat Red Hat:jboss_enterprise_web_server:5.8::el9 | All versions | 0:9.0.87-6.redhat_00006.1.el9jws |
Products include Apache Tomcat, Netapp Bootstrap Os.
How do I fix CVE-2024-50379?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.34, 11.0.2 or 9.0.98.
Is CVE-2024-50379 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-50379 exists.
Public exploit code: 15 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2024-50379, CLSA-2025-1745585424, DEBIAN-CVE-2024-50379, GHSA-5j33-cvvr-w245, RHSA-2025:0342, RHSA-2025:0361 and 3 more.