CVE-2024-54677
Publication date 17 December 2024
Last updated 13 August 2025
Ubuntu priority
Description
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Why is this CVE low priority?
DoS in example web application only.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| tomcat6 | 25.04 plucky | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
|
| tomcat7 | 25.04 plucky | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
|
| tomcat8 | 25.04 plucky | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| tomcat9 | 25.04 plucky |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| tomcat10 | 25.04 plucky |
Not affected
|
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.3 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-54677
- https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n
- https://github.com/apache/tomcat/commit/f57a9d9847c1038be61f5818d73b8be907c460d4 (10.1.34)
- https://github.com/apache/tomcat/commit/aa5b4d0043289cf054f531ec55126c980d3572e1 (10.1.34)
- https://github.com/apache/tomcat/commit/e8c16cdba833884e1bd49fff1f1cb699da177585 (10.1.34)
- https://github.com/apache/tomcat/commit/dbec927859d9484cb8bd680a7c67b1a560f48444 (10.1.34)
- https://github.com/apache/tomcat/commit/d63a10afc142b12f462a15f7d10f79fd80ff94eb (10.1.34)
- https://github.com/apache/tomcat/commit/54e56495e9a106218efe9fc9c79d976c0032bbfd (10.1.34)
- https://github.com/apache/tomcat/commit/bbd82e9593314ade4cfd57248f9285fbad686f66 (10.1.34)
- https://github.com/apache/tomcat/commit/1d88dd3ffaed76188dd4ee32ce77709ce6e153cd (9.0.98)
- https://github.com/apache/tomcat/commit/721544ea28e92549824b106be954a9f411867a1c (9.0.98)
- https://github.com/apache/tomcat/commit/84065e26ca4555e63a922bb29b13b0a1c86b7654 (9.0.98)
- https://github.com/apache/tomcat/commit/3315a9027a7eaab18f42625b97b569940ff1365d (9.0.98)
- https://github.com/apache/tomcat/commit/c2f7ce21c3fb12caefee87c517a8bb4f80700044 (9.0.98)
- https://github.com/apache/tomcat/commit/75ff7e8622edcc024b268677aa789ee8f0880ecc (9.0.98)
- https://github.com/apache/tomcat/commit/4d5cc6538d91386f950373ac8120e98c2c78ed3a (9.0.98)
- https://github.com/apache/tomcat/commit/84c4af76e7a10fc7f8630ce62e6a46632ea4a90e (9.0.98)
- https://github.com/apache/tomcat/commit/9ffd23fc27f5d1fc95bf97e5cea175c8968f4533 (9.0.98)
- http://www.openwall.com/lists/oss-security/2024/12/17/5
- http://www.openwall.com/lists/oss-security/2024/12/17/6