CVE-2024-38286

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Allocation of Resources Without Limits or Throttling pada apache tomcat, netapp ontap tools. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

Rincian

Terbit di NVD

7 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.netapp.com/advisory/ntap-20241101-0010/ advisory pihak ketiga
• https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s mailing list
• http://www.openwall.com/lists/oss-security/2024/09/23/2 mailing list
• https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html