CVE-2024-23672CWE-459

Apache Tomcat: WebSocket DoS with incomplete closing handshake

Medium · published March 13, 2024

CVSS v3.1
6.3
EPSS
2%
Percentile
83.3
In the wild
Unconfirmed
What it is

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.

Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02313 · 83.3th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2024-03-13T15:48Z
EPSS history
Timeline
  • 13 MAR 15:48Z
    Apache Tomcat: WebSocket DoS with incomplete closing handshake
    cvelistv5