CVE-2024-52317

Published: Nov 18, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

Affected (6)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 10.1.27 to 10.1.31
Apache Tomcat	From 9.0.92 to 9.0.96
Apache Tomcat	Version 11.0.0 milestone23
Apache Tomcat	Version 11.0.0 milestone24
Apache Tomcat	Version 11.0.0 milestone25
Apache Tomcat	Version 11.0.0 milestone26

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (3)

https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/11/18/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20250124-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.