{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34750", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-05-08T07:23:16.760Z", "datePublished": "2024-07-03T19:32:34.695Z", "dateUpdated": "2024-08-16T17:02:39.887Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "11.0.0-M20", "status": "affected", "version": "11.0.0-M1", "versionType": "semver"}, {"lessThanOrEqual": "10.1.24", "status": "affected", "version": "10.1.0-M1", "versionType": "semver"}, {"lessThanOrEqual": "9.0.89", "status": "affected", "version": "9.0.0-M1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "devme4f from VNPT-VCI"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.</p><p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.</p><p>Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.</p>"}], "value": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n"}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-07-03T19:32:34.695Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Tomcat: HTTP/2 excess header handling DoS", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "apache", "product": "tomcat", "cpes": ["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "9.0.0-m1", "status": "affected", "lessThanOrEqual": "9.0.89", "versionType": "semver"}, {"version": "10.1.0-m1", "status": "affected", "lessThanOrEqual": "10.1.24", "versionType": "semver"}, {"version": "11.0.0-m1", "status": "affected", "lessThanOrEqual": "11.0.0-m20", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-08T16:51:20.954347Z", "id": "CVE-2024-34750", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T16:05:56.107Z"}}, {"title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l"}, {"url": "https://security.netapp.com/advisory/ntap-20240816-0004/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-16T17:02:39.887Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240816-0004/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-16T17:02:39.887Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-34750", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-08T16:51:20.954347Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "tomcat", "versions": [{"status": "affected", "version": "9.0.0-m1", "versionType": "semver", "lessThanOrEqual": "9.0.89"}, {"status": "affected", "version": "10.1.0-m1", "versionType": "semver", "lessThanOrEqual": "10.1.24"}, {"status": "affected", "version": "11.0.0-m1", "versionType": "semver", "lessThanOrEqual": "11.0.0-m20"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-08T16:54:33.007Z"}}], "cna": {"title": "Apache Tomcat: HTTP/2 excess header handling DoS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "devme4f from VNPT-VCI"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M1", "versionType": "semver", "lessThanOrEqual": "11.0.0-M20"}, {"status": "affected", "version": "10.1.0-M1", "versionType": "semver", "lessThanOrEqual": "10.1.24"}, {"status": "affected", "version": "9.0.0-M1", "versionType": "semver", "lessThanOrEqual": "9.0.89"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.</p><p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.</p><p>Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-07-03T19:32:34.695Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34750", "state": "PUBLISHED", "dateUpdated": "2024-08-16T17:02:39.887Z", "dateReserved": "2024-05-08T07:23:16.760Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-07-03T19:32:34.695Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n"}, {"lang": "es", "value": "Manejo inadecuado de condiciones excepcionales, vulnerabilidad de consumo incontrolado de recursos en Apache Tomcat. Al procesar una secuencia HTTP/2, Tomcat no manej\u00f3 correctamente algunos casos de encabezados HTTP excesivos. Esto llev\u00f3 a un conteo err\u00f3neo de flujos HTTP/2 activos que a su vez llev\u00f3 al uso de un tiempo de espera infinito incorrecto que permiti\u00f3 que las conexiones permanecieran abiertas y que deber\u00edan haberse cerrado. Este problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.0-M20, desde 10.1.0-M1 hasta 10.1.24, desde 9.0.0-M1 hasta 9.0.89. Se recomienda a los usuarios actualizar a la versi\u00f3n 11.0.0-M21, 10.1.25 o 9.0.90, que soluciona el problema."}], "id": "CVE-2024-34750", "lastModified": "2024-07-09T16:22:37.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-07-03T20:15:04.083", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-755"}], "source": "security@apache.org", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5694", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "tomcat-1:9.0.87-1.el8_10.2", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:5695", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "tomcat-1:9.0.87-1.el8_8.3", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:5693", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "tomcat-1:9.0.87-1.el9_4.2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:5696", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "tomcat-1:9.0.87-1.el9_2.2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:5025", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8", "package": "jws5-tomcat", "product_name": "Red Hat JBoss Web Server 5", "release_date": "2024-08-06T00:00:00Z"}, {"advisory": "RHSA-2024:5024", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el7", "package": "jws5-tomcat-0:9.0.87-5.redhat_00005.1.el7jws", "product_name": "Red Hat JBoss Web Server 5.8 on RHEL 7", "release_date": "2024-08-06T00:00:00Z"}, {"advisory": "RHSA-2024:5024", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el8", "package": "jws5-tomcat-0:9.0.87-5.redhat_00005.1.el8jws", "product_name": "Red Hat JBoss Web Server 5.8 on RHEL 8", "release_date": "2024-08-06T00:00:00Z"}, {"advisory": "RHSA-2024:5024", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el9", "package": "jws5-tomcat-0:9.0.87-5.redhat_00005.1.el9jws", "product_name": "Red Hat JBoss Web Server 5.8 on RHEL 9", "release_date": "2024-08-06T00:00:00Z"}, {"advisory": "RHSA-2024:4977", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.0", "package": "jws6-tomcat", "product_name": "Red Hat JBoss Web Server 6", "release_date": "2024-08-06T00:00:00Z"}, {"advisory": "RHSA-2024:4976", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.0::el8", "package": "jws6-tomcat-0:10.1.8-10.redhat_00018.1.el8jws", "product_name": "Red Hat JBoss Web Server 6.0 on RHEL 8", "release_date": "2024-08-06T00:00:00Z"}, {"advisory": "RHSA-2024:4976", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.0::el9", "package": "jws6-tomcat-0:10.1.8-10.redhat_00018.1.el9jws", "product_name": "Red Hat JBoss Web Server 6.0 on RHEL 9", "release_date": "2024-08-06T00:00:00Z"}], "bugzilla": {"description": "tomcat: Improper Handling of Exceptional Conditions", "id": "2295651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295651"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "(CWE-400|CWE-755)", "details": ["Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.", "A vulnerability was found in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This issue led to a miscounting of active HTTP/2 streams, which in turn led to using an incorrect infinite timeout that allowed connections to remain open that should have been closed."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-34750", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "tomcat6", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "pki-servlet-engine", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-34750\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-34750\nhttps://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l"], "statement": "This vulnerability in Apache Tomcat is significant due to its impact on the stability and security of web applications relying on HTTP/2. The improper handling of excessive HTTP headers during HTTP/2 stream processing leads to an inaccurate count of active streams. This miscount causes the application to apply an incorrect infinite timeout, allowing connections to persist indefinitely. Such behavior results in uncontrolled resource consumption, potentially exhausting server resources and leading to denial of service (DoS) conditions. By exploiting this flaw, an attacker could degrade the performance or availability of the server.", "threat_severity": "Important"}