CVE-2024-54677

EUVD-2024-3539
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Affected Products (NVD)
VendorProductVersion
apachetomcat
9.0.0 ≤
𝑥
< 9.0.98
apachetomcat
10.1.0 ≤
𝑥
< 10.1.34
apachetomcat
11.0.0 ≤
𝑥
< 11.0.2
netappbootstrap_os
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tomcat10
bookworm
10.1.34-0+deb12u2
fixed
bookworm (security)
10.1.34-0+deb12u2
fixed
forky
10.1.46-1
fixed
sid
10.1.46-1
fixed
trixie
10.1.40-1
fixed
tomcat9
bookworm
9.0.70-2
fixed
bullseye
vulnerable
bullseye (security)
9.0.107-0+deb11u1
fixed
forky
9.0.111-1
fixed
sid
9.0.111-1
fixed
trixie
9.0.95-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tomcat6
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
trusty
needs-triage
xenial
needs-triage
tomcat7
bionic
needs-triage
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
trusty
needs-triage
xenial
needs-triage
tomcat8
bionic
needed
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
xenial
needed
tomcat10
focal
dne
jammy
dne
noble
Fixed 10.1.16-1ubuntu0.1~esm3
released
oracular
ignored
plucky
not-affected
questing
not-affected
tomcat9
bionic
needed
focal
needed
jammy
needed
noble
not-affected
oracular
ignored
plucky
not-affected
questing
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
tomcat
suse enterprise sap 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP7
9.0.98-150200.74.1
fixed
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP2
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP7
9.0.98-150200.74.1
fixed
tomcat-admin-webapps
suse enterprise sap 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP7
9.0.98-150200.74.1
fixed
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP2
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP7
9.0.98-150200.74.1
fixed
tomcat-docs-webapp
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
tomcat-el-3_0-api
suse enterprise sap 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP7
9.0.98-150200.74.1
fixed
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP2
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP7
9.0.98-150200.74.1
fixed
tomcat-javadoc
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
tomcat-jsp-2_3-api
suse enterprise sap 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP7
9.0.98-150200.74.1
fixed
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP2
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP7
9.0.98-150200.74.1
fixed
tomcat-lib
suse enterprise sap 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP7
9.0.98-150200.74.1
fixed
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP2
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP7
9.0.98-150200.74.1
fixed
tomcat-servlet-3_1-api
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
tomcat-servlet-4_0-api
suse enterprise sap 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP7
9.0.98-150200.74.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP2
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP7
9.0.98-150200.74.1
fixed
tomcat-webapps
suse enterprise sap 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise sap 15 SP7
9.0.98-150200.74.1
fixed
suse enterprise server 12 SP3
8.0.53-29.80.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP2
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP3
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP4
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP5
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP6
9.0.98-150200.74.1
fixed
suse enterprise server 15 SP7
9.0.98-150200.74.1
fixed
tomcat10
suse enterprise sap 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP7
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP7
10.1.34-150200.5.31.1
fixed
tomcat10-admin-webapps
suse enterprise sap 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP7
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP7
10.1.34-150200.5.31.1
fixed
tomcat10-el-5_0-api
suse enterprise sap 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP7
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP7
10.1.34-150200.5.31.1
fixed
tomcat10-jsp-3_1-api
suse enterprise sap 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP7
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP7
10.1.34-150200.5.31.1
fixed
tomcat10-lib
suse enterprise sap 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP7
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP7
10.1.34-150200.5.31.1
fixed
tomcat10-servlet-6_0-api
suse enterprise sap 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP7
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP7
10.1.34-150200.5.31.1
fixed
tomcat10-webapps
suse enterprise sap 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise sap 15 SP7
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP5
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP6
10.1.34-150200.5.31.1
fixed
suse enterprise server 15 SP7
10.1.34-150200.5.31.1
fixed
Common Weakness Enumeration
References
https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n
http://www.openwall.com/lists/oss-security/2024/12/17/5
http://www.openwall.com/lists/oss-security/2024/12/17/6
http://www.openwall.com/lists/oss-security/2024/12/18/1
https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
https://security.netapp.com/advisory/ntap-20250131-0006/