CVE-2024-52317: Apache Tomcat Request and/or response mix-up
(updated )
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.
Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
References
- github.com/advisories/GHSA-qvf5-hvjx-wm27
- github.com/apache/tomcat
- github.com/apache/tomcat/commit/146f94f87ea398fb592c7a20a5ccbef95e9dd72b
- github.com/apache/tomcat/commit/47307ee27abcdea2ee40e33897aca760083de46a
- github.com/apache/tomcat/commit/9e840ccacb40881c03a03b1e0746bfba7369b3bd
- lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs
- nvd.nist.gov/vuln/detail/CVE-2024-52317
- security.netapp.com/advisory/ntap-20250124-0004
Code Behaviors & Features
Detect and mitigate CVE-2024-52317 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →