Vulnerability in Apache Tomcat
CVE-2024-23672
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 th…
EPSS: 0.023 (81.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Apache Tomcat — versions 11.0.0
- Apache Software Foundation Tomcat — versions 11.0.0-M1, 10.1.0-M1, 9.0.0-M1
- Debian Debian_linux — versions 10.0
- Fedoraproject Fedora — versions 39, 40
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
Frequently asked questions
- What is CVE-2024-23672?
- CVE-2024-23672 is a medium-severity vulnerability in Apache Tomcat, classified under Incomplete Cleanup. CVSS score: 6.3/10. Published 2024-03-13.
- How severe is CVE-2024-23672?
- Medium severity. CVSS v3 base score is 6.3 out of 10.
- Is CVE-2024-23672 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.