CVE-2024-24549

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

• CWE-20

• https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvgVendor Advisory
• http://www.openwall.com/lists/oss-security/2024/03/13/3Mailing List
• https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvgVendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00001.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240402-0002/Third Party Advisory

Published

Mar 13, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24528Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-2453 There is an SQL injection vulnerability in Advantech WebAcc…6.4
• CVE-2024-24539FusionPBX before 5.2.0 does not validate a session.5.3
• CVE-2024-2454An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2024-24543Buffer Overflow vulnerability in the function setSchedWifi i…9.8
• CVE-2024-24548Payment EX Ver1.1.5b and earlier allows a remote unauthentic…6.5
• CVE-2024-2455The Element Pack - Addon for Elementor Page Builder WordPres…5.4
• CVE-2024-24550A security vulnerability has been identified in Bludit, allo…8.1
• CVE-2024-24551A security vulnerability has been identified in Bludit, allo…8.8
• CVE-2024-24552A session fixation vulnerability in Bludit allows an attacke…8.8
• CVE-2024-24553Bludit uses the SHA-1 hashing algorithm to compute password …7.5
• CVE-2024-24554Bludit uses predictable methods in combination with the MD5 …8.2