CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-24549

High Severity
SVRS
42/100
CVSSv3
NA/10
EPSS
0.57387/1

CVE-2024-24549 is a Denial of Service vulnerability in Apache Tomcat caused by improper input validation. This vulnerability allows attackers to potentially crash a Tomcat server by sending specially crafted HTTP/2 requests that exceed configured header limits. The vulnerability impacts Apache Tomcat versions 11.0.0-M1 through 11.0.0-M16, 10.1.0-M1 through 10.1.18, 9.0.0-M1 through 9.0.85, and 8.5.0 through 8.5.98. Although the CVSS score is 0, the SOCRadar Vulnerability Risk Score (SVRS) is 42, indicating a moderate level of risk, especially considering the availability of active exploits. This means attackers are actively trying to leverage this flaw. Upgrade to Apache Tomcat versions 11.0.0-M17, 10.1.19, 9.0.86, or 8.5.99 to mitigate this risk and ensure service availability. The existence of exploit available makes patching urgent.

TAGS
In The Wild
Exploit Avaliable
Vendor-advisory
VECTOR STRING
PUBLICATION DATE2024-03-13
LAST MODIFIED2025-02-13
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-24549 is a Denial of Service vulnerability in Apache Tomcat due to improper input validation in HTTP/2 requests. This vulnerability allows an attacker to send a specially crafted HTTP/2 request that exceeds the configured header limits, causing the server to process the entire request before resetting the stream. This can lead to a denial of service condition.

Key Insights

  • The SVRS of 30 indicates that this vulnerability is of moderate severity and requires attention.
  • This vulnerability affects a wide range of Apache Tomcat versions, making it a potential target for attackers.
  • The vulnerability is actively exploited in the wild, making it a critical threat to organizations using Apache Tomcat.

Mitigation Strategies

  • Upgrade to Apache Tomcat version 11.0.0-M17, 10.1.19, 9.0.86, or 8.5.99, which fix the issue.
  • Implement input validation mechanisms to prevent attackers from sending malformed HTTP/2 requests.
  • Monitor network traffic for suspicious activity and block any attempts to exploit this vulnerability.

Additional Information

  • Threat Actors/APT Groups: Not specified
  • Exploit Status: Active exploits have been published
  • CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
  • In the Wild: Yes

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

TitleSoftware LinkDate
JFOZ1010/CVE-2024-24549https://github.com/JFOZ1010/CVE-2024-245492024-12-09
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-24549 | Apache Tomcat up to 8.5.98/9.0.85/10.1.18/11.0.0-M16 HTTP/2 Request denial of service (DLA 3779-1)
vuldb.com2024-06-13
CVE-2024-24549 | Apache Tomcat up to 8.5.98/9.0.85/10.1.18/11.0.0-M16 HTTP/2 Request denial of service (DLA 3779-1) | A vulnerability was found in Apache Tomcat up to 8.5.98/9.0.85/10.1.18/11.0.0-M16. It has been classified as problematic. Affected is an unknown function of the component HTTP2 Request Handler. The manipulation leads to denial of service. This vulnerability is traded as CVE-2024-24549. It is possible to
cve-2024-24549
domains
urls
cves
New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks - The Hacker News
2024-04-04
New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks - The Hacker News | News Content: New research has found that the CONTINUATION frame in the HTTP/2 protocol can be exploited to conduct denial-of-service (DoS) attacks. The technique has been codenamed HTTP/2 CONTINUATION Flood by security researcher Bartek Nowotarski, who reported the issue to the CERT Coordination Center (CERT/CC) on January 25, 2024. "Many HTTP/2 implementations do not properly limit or sanitize the amount of CONTINUATION frames sent within a single stream," CERT/CC said in an advisory on April 3, 2024. "An attacker that can send packets to a target
google.com
rss
forum
news
What you should know: HTTP/2 CONTINUATION Flood Vulnerability
Mario Teixeira2024-04-10
What you should know: HTTP/2 CONTINUATION Flood Vulnerability | A new class of vulnerabilities in specific implementations of the HTTP/2 protocol, dubbed &#8220;HTTP/2 CONTINUATION Flood,&#8221; has been discovered, causing concern across the Internet. Various affected products have already been identified and assigned CVEs, with more expected to be disclosed &#8230; Read More <
cve-2024-28182
cve-2024-24549
cve-2024-2653
cve-2024-27983

Social Media

CVE-2024-24549 The critical vulnerability in Apache Tomcat is a denial of service due to improper input validation for HTTP/2 requests leading to potential DoS conditions. If the request exceeded any of the configured limits for headers and the associated HTTP/2 stream was not https://t.co/AQOYFrhTCk
0
0
0

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
[email protected]https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
[email protected]https://security.netapp.com/advisory/ntap-20240402-0002/
[email protected]https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
[email protected]https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html
[email protected]https://security.netapp.com/advisory/ntap-20240402-0002/
[email protected]http://www.openwall.com/lists/oss-security/2024/03/13/3
[email protected]https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
[email protected]https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html
[email protected]https://security.netapp.com/advisory/ntap-20240402-0002/
[email protected]http://www.openwall.com/lists/oss-security/2024/03/13/3
[email protected]https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
[email protected]https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html
[email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/
[email protected]https://security.netapp.com/advisory/ntap-20240402-0002/
[email protected]http://www.openwall.com/lists/oss-security/2024/03/13/3
[email protected]https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
[email protected]https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html
[email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/
[email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/
[email protected]https://security.netapp.com/advisory/ntap-20240402-0002/
AF854A3A-2127-422B-91AE-364DA2661108http://www.openwall.com/lists/oss-security/2024/03/13/3
AF854A3A-2127-422B-91AE-364DA2661108https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
AF854A3A-2127-422B-91AE-364DA2661108https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html
AF854A3A-2127-422B-91AE-364DA2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/
AF854A3A-2127-422B-91AE-364DA2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/
AF854A3A-2127-422B-91AE-364DA2661108https://security.netapp.com/advisory/ntap-20240402-0002/
[email protected]http://www.openwall.com/lists/oss-security/2024/03/13/3
[email protected]https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
[email protected]https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html
[email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/
[email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/
[email protected]https://security.netapp.com/advisory/ntap-20240402-0002/

CWE Details

CWE IDCWE NameDescription
CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence