Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-34750

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

Published

2024-07-03T20:15:04.083

Last Modified

2025-08-08T11:15:27.587

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-400
    CWE-755
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache tomcat < 9.0.90 Yes
Application apache tomcat < 10.1.25 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application apache tomcat 11.0.0 Yes
Application netapp ontap_tools 9 Yes
References