CVE-2024-34750

Katalog CVE

CVSS 7.5 · High EPSS 4,6%

Kerentanan Uncontrolled Resource Consumption pada apache tomcat, netapp ontap tools. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

Rincian

Terbit di NVD

3 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

4,6% peluang dieksploitasi; lebih tinggi dari 91,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l advisory vendor
• https://security.netapp.com/advisory/ntap-20240816-0004/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html