CVE-2024-23672

Published: Mar 13, 2024Modified: Jun 17, 2026

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

Affected (22)

Products: Apache: Tomcat · Debian: Debian Linux · Fedoraproject: Fedora

1 product

1 product

1 product

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 10.1.0 to 10.1.19
Apache Tomcat	From 8.5.0 to 8.5.99
Apache Tomcat	From 9.0.0 to 9.0.86
Apache Tomcat	Version 11.0.0 milestone10
Apache Tomcat	Version 11.0.0 milestone11
Apache Tomcat	Version 11.0.0 milestone12
Apache Tomcat	Version 11.0.0 milestone13
Apache Tomcat	Version 11.0.0 milestone14
Apache Tomcat	Version 11.0.0 milestone15
Apache Tomcat	Version 11.0.0 milestone16
Apache Tomcat	Version 11.0.0 milestone1
Apache Tomcat	Version 11.0.0 milestone2
Apache Tomcat	Version 11.0.0 milestone3
Apache Tomcat	Version 11.0.0 milestone4
Apache Tomcat	Version 11.0.0 milestone5
Apache Tomcat	Version 11.0.0 milestone6
Apache Tomcat	Version 11.0.0 milestone7
Apache Tomcat	Version 11.0.0 milestone8
Apache Tomcat	Version 11.0.0 milestone9