CVE-2024-54677
Last modified
CVE-2024-54677 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.. EPSS estimates a 1.91% chance of exploitation in the next 30 days.
Description
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 9.0.0, < 9.0.98 |
| Apache | Tomcat | >= 10.1.0, < 10.1.34 |
| Apache | Tomcat | >= 11.0.0, < 11.0.2 |
| Netapp | Bootstrap Os | All versions |
References
- https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2nMailing List, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20250131-0006/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-54677?
How severe is CVE-2024-54677?
How do I fix CVE-2024-54677?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-54663An issue was discovered in the Webmail Classic UI in Zimbra …7.5
- CVE-2024-54664Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2024-5467Zohocorp ManageEngine ADAudit Plus versions below 8121 are v…8.8
- CVE-2024-54674app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MI…6.1
- CVE-2024-54675app/webroot/js/workflows-editor/workflows-editor.js in MISP …6.1
- CVE-2024-54676Vendor: The Apache Software Foundation Versions Affected: A…9.8
- CVE-2024-54678A vulnerability has been identified in SIMATIC PCS neo V4.1 …8.6
- CVE-2024-54679CyberPanel (aka Cyber Panel) before 6778ad1 does not require…6.5
- CVE-2024-5468The WordPress Header Builder Plugin – Pearl plugin for WordP…6.5
- CVE-2024-54680Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2024-54681Multiple bash files were present in the application's privat…3.5
- CVE-2024-54682Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11…4.9
Are you affected by CVE-2024-54677?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST