Vulnerability Description
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 9.0.92, < 9.0.96 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfsMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2024/11/18/3Mailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20250124-0004/Third Party Advisory
FAQ
What is CVE-2024-52317?
CVE-2024-52317 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between use...
How severe is CVE-2024-52317?
CVE-2024-52317 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-52317?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat.