CVE-2024-52317

Apache Tomcat: Request/response mix-up with HTTP/2

Medium · published November 18, 2024

CVSS v3.1
6.5
EPSS
2%
Percentile
81.5
In the wild
Unconfirmed
What it is

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests

could lead to request and/or response mix-up between users.

This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.

Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02097 · 81.5th percentile
Published
2024-11-18T11:36Z
EPSS history
Timeline
  • 18 NOV 11:36Z
    Apache Tomcat: Request/response mix-up with HTTP/2
    cvelistv5