CVE-2024-50379 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 |
| Fixed in | 11.0.2, 10.1.34, 9.0.98 |
| Weakness | CWE-367 |
| Published | 17 Dec 2024 |
| Updated | 3 Nov 2026 |
Description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: yes, technical impact: total.
- Indexed PoC 14 indexed Published artifacts you can open, in GitHub PoC; first seen 2024-12-18.
- EPSS 32% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
Waratek protection
A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.
- Protection none
- Action unverified
- Review automated Inferred
- Record active
| Decided by | The affected package being open source on Maven, so the fix can be read |
|---|---|
| Finding | This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.tomcat:tomcat-catalina, org.apache.tomcat.embed:tomcat-embed-core), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on. |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2025 ↗ | CPU | 2025-Q2 | Oracle Communications / Automated Test Suite (Apache Tomcat) (24.2.0) Oracle Communications / BEServer (Apache Tomcat) (24.3.0) Oracle Financial Services Applications / Installer (Apache Tomcat) (8.1.2.7.0) Oracle Fusion Middleware / Runtime Server (Apache Tomcat) (12.2.1.4.0) Oracle Supply Chain / Document Management (Apache Tomcat) (6.2.1) |
| Oracle Critical Patch Update January 2025 ↗ | CPU | 2025-Q1 | Oracle Communications / Configuration Management Platform (Apache Tomcat) (15.0.0.0.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Automated Test Suite (Apache Tomcat) | 24.2.0 | 24.2.0 |
| Oracle Communications | BEServer (Apache Tomcat) | 24.3.0 | 24.3.0 |
| Oracle Communications | Configuration Management Platform (Apache Tomcat) | 15.0.0.0.0 | 15.0.0.0.0 |
| Oracle Financial Services Applications | Installer (Apache Tomcat) | 8.1.2.7.0 | 8.1.2.7.0 |
| Oracle Fusion Middleware | Runtime Server (Apache Tomcat) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Supply Chain | Document Management (Apache Tomcat) | 6.2.1 | 6.2.1 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat:tomcat-catalina |
11.0.0-M1 | 11.0.2 |
unbounded |
org.apache.tomcat:tomcat-catalina |
10.1.0-M1 | 10.1.34 |
unbounded |
org.apache.tomcat:tomcat-catalina |
9.0.0.M1 | 9.0.98 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
11.0.0-M1 | 11.0.2 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
10.1.0-M1 | 10.1.34 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
9.0.0.M1 | 9.0.98 |
unbounded |
org.apache.tomcat:tomcat-catalina |
8.5.0 | none | 8.5.100 |
org.apache.tomcat.embed:tomcat-embed-core |
8.5.0 | none | 8.5.100 |
Products and versions
4 products, 12 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | ≥ 9.0.0 and ＜ 9.0.98 · ≥ 10.1.0 and ＜ 10.1.34 · ≥ 11.0.0 and ＜ 11.0.2 |
| nvd | netapp | bootstrap os | generic | any version |
| osv | org.apache.tomcat | tomcat-catalina | generic | ≥ 8.5.0 and ≤ 8.5.100 · ≥ 9.0.0 and ＜ 9.0.98 · ≥ 10.1.0 and ＜ 10.1.34 · ≥ 11.0.0 and ＜ 11.0.2 |
| osv | org.apache.tomcat.embed | tomcat-embed-core | generic | ≥ 8.5.0 and ≤ 8.5.100 · ≥ 9.0.0 and ＜ 9.0.98 · ≥ 10.1.0 and ＜ 10.1.34 · ≥ 11.0.0 and ＜ 11.0.2 |
References
Timeline
Timeline
| Published | 2024-12-17 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-11-03 | NVD's own last-modified date for this record. |