CVE-2024-52317

Apache Tomcat: Request/response mix-up with HTTP/2

State: Published
Severity: 6.5 Medium
Published: Nov 18, 2024
Updated: Jan 24, 2025
Reserved: Nov 7, 2024

Description

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users.

This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.

Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	CISA-ADP

Weaknesses

CWE-326 Inadequate Encryption Strength

Affected Products

Product	Versions
Apache TomcatApache Software Foundation	11.0.0-M23 through 11.0.0-M26Affected 10.1.27 through 10.1.30Affected 9.0.92 through 9.0.95Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.