CVE-2024-34750

highpriority · track · 2EPSS 0.046 · 92 %ileDEEUNLRUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
4.60% (92nd) EPSS
CVSS 7.5 · high
Is it mine?
154 products
Check your exposure
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-22

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedtomcat-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-admin-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-admin-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-docs-webapp-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-docs-webapp-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-el-3_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-el-3_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-javadoc-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-javadoc-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-jsp-2_3-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-jsp-2_3-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-lib-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-lib-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-servlet-4_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-servlet-4_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedtomcat-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · SUSE Product Security
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-400USCWE-400USCWE-755USCWE-755USCWE-755USCWE-755US
05

affected products (154)

Products and version ranges known to be affected.

showing 20 of 154
06

advisories (20)

Vendor and ecosystem advisories describing this.

  • NCSC-2024-0411Kwetsbaarheden verholpen in Oracle Database productenNL2024-10-17csaf · ncsc_nlNL

    Oracle heeft kwetsbaarheden verholpen in diverse Database producten en subsystemen, zoals de Core database, Application Express, Autonomous Health Framework, Essbase, GoldenGate, SQL Developer en Secure Backup.

  • NCSC-2024-0413Kwetsbaarheden verholpen in Oracle CommerceNL2024-10-17csaf · ncsc_nlNL

    Oracle heeft kwetsbaarheden verholpen in Commerce.

  • NCSC-2024-0414Kwetsbaarheden verholpen in Oracle CommunicationsNL2024-10-17csaf · ncsc_nlNL

    Oracle heeft kwetsbaarheden verholpen in diverse Communications producten en systemen.

  • NCSC-2024-0466Kwetsbaarheden verholpen in Atlassian productenNL2024-12-06csaf · ncsc_nlNL

    Atlassian heeft kwetsbaarheden verholpen in diverse producten als Jira, Bamboo en Confluence.

  • NCSC-2025-0021Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-01-22csaf · ncsc_nlNL

    Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.

  • NCSC-2025-0025Kwetsbaarheden verholpen in Oracle Financial ServicesNL2025-01-22csaf · ncsc_nlNL

    Oracle heeft meerdere kwetsbaarheden verholpen in Financial Services en componenten.

  • NCSC-2025-0027Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2025-01-22csaf · ncsc_nlNL

    Oracle heeft meerdere kwetsbaarheden verholpen in zijn producten, waaronder Oracle Fusion Middleware, Oracle WebLogic Server, en Oracle HTTP Server.

  • SUSE-SU-2026:1058-1Security update for tomcat2026-03-26csaf · suse_csafDE

    Security update for tomcat

  • WID-SEC-W-2024-1522Apache Tomcat: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-07-03csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen.

  • WID-SEC-W-2024-1905IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2024-08-21csaf · cert_bundDE

    Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, eine Man-in-the-Middle-Situation zu schaffen, Sicherheitsmaßnahmen zu umgehen oder eine Denial-of-Service-Situation zu schaffen.

  • WID-SEC-W-2024-2100IBM Power Hardware Management Console: Mehrere SchwachstellenDeutsch2024-09-10csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in IBM Power Hardware Management Console ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.

  • WID-SEC-W-2024-3195Oracle Communications: Mehrere SchwachstellenDeutsch2024-10-15csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2024-3197Oracle Commerce: Mehrere SchwachstellenDeutsch2024-10-15csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2025-0143Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2025-0144Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2025-0148Oracle Communications: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2025-0161Oracle Utilities Applications: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2025-0163Oracle Supply Chain: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • GHSA-wm9w-rjj3-j356Apache Tomcat - Denial of Service2024-07-03ghsa · osvUS

    Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

  • BIT-tomcat-2024-34750Apache Tomcat: HTTP/2 excess header handling DoS2025-07-29vendor · osvUS

    Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.24, from 9.0.0 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0, 10.1.25 or 9.0.90, which fixes the issue.

07

also known as (6)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundncsc_nlsuse_csafNVDCVE.orgMITRE
published 2024-07-03modified 2026-09-23
09

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan