CVE-2024-23672: Denial of Service via incomplete cleanup vulnerability in Apache Tomcat
(updated )
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.
Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
References
- github.com/advisories/GHSA-v682-8vv8-vpwr
- github.com/apache/tomcat
- github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501
- github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591
- github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068
- github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9
- lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f
- nvd.nist.gov/vuln/detail/CVE-2024-23672
Detect and mitigate CVE-2024-23672 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →