CVE-2024-38286
libtomcat9-embed-java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat
CVE-2024-38286 is fixed in 24 products on 1 platform, first by RHSA-2024:5694, released August 21, 2024. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0169
77th percentile
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libtomcat10-embed-java · Ubuntu 24.04.5 LTS (noble) | 10.1.16-1ubuntu0.1~esm2 | libtomcat10-embed-java 10.1.16-1ubuntu0.1~esm2 | Nov 7, 2024 |
| libtomcat10-java · Ubuntu 24.04.5 LTS (noble) | 10.1.16-1ubuntu0.1~esm2 | libtomcat10-java 10.1.16-1ubuntu0.1~esm2 | Nov 7, 2024 |
| libtomcat9-embed-java · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3ubuntu0.18.04.2+esm7 | libtomcat9-embed-java 9.0.16-3ubuntu0.18.04.2+esm7 | Nov 7, 2024 |
| libtomcat9-embed-java · Ubuntu 20.04 LTS (focal) | 9.0.31-1ubuntu0.9+esm2 | libtomcat9-embed-java 9.0.31-1ubuntu0.9+esm2 | Nov 7, 2024 |
| libtomcat9-embed-java · Ubuntu 22.04.1 LTS (jammy) | 9.0.58-1ubuntu0.2+esm3 | libtomcat9-embed-java 9.0.58-1ubuntu0.2+esm3 | Nov 7, 2024 |
| libtomcat9-java · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3ubuntu0.18.04.2+esm7 | libtomcat9-java 9.0.16-3ubuntu0.18.04.2+esm7 | Nov 7, 2024 |
| libtomcat9-java · Ubuntu 20.04 LTS (focal) | 9.0.31-1ubuntu0.9+esm2 | libtomcat9-java 9.0.31-1ubuntu0.9+esm2 | Nov 7, 2024 |
| libtomcat9-java · Ubuntu 22.04.1 LTS (jammy) | 9.0.58-1ubuntu0.2+esm3 | libtomcat9-java 9.0.58-1ubuntu0.2+esm3 | Nov 7, 2024 |
| libtomcat9-java · Ubuntu 24.04.5 LTS (noble) | 9.0.70-2ubuntu0.1+esm2 | libtomcat9-java 9.0.70-2ubuntu0.1+esm2 | Nov 7, 2024 |
| libtomcat9-java · Ubuntu 24.10 (oracular) | 9.0.70-2ubuntu1.24.10.2 | libtomcat9-java 9.0.70-2ubuntu1.24.10.2 | Jan 16, 2026 |
| libtomcat9-java · Ubuntu 25.04 (plucky) | 9.0.70-2ubuntu1.25.04.2 | libtomcat9-java 9.0.70-2ubuntu1.25.04.2 | Jan 16, 2026 |
| libtomcat9-java · Ubuntu 25.10 (questing) | 9.0.70-2ubuntu3 | libtomcat9-java 9.0.70-2ubuntu3 | Nov 7, 2024 |
| tomcat · RHEL 8 | 1:9.0.87-1.el8_10.2 | RHSA-2024:5694 | Aug 21, 2024 |
| tomcat · RHEL 9 | 1:9.0.87-1.el9_4.2 | RHSA-2024:5693 | Aug 21, 2024 |
| tomcat · almalinux 8 | 1:9.0.87-1.el8_10.2 | ALSA-2024:5694 | Aug 21, 2024 |
| tomcat-admin-webapps · RHEL 8 | 1:9.0.87-1.el8_10.2 | RHSA-2024:5694 | Aug 21, 2024 |
| tomcat-admin-webapps · RHEL 9 | 1:9.0.87-1.el9_4.2 | RHSA-2024:5693 | Aug 21, 2024 |
| tomcat-admin-webapps · almalinux 8 | 1:9.0.87-1.el8_10.2 | ALSA-2024:5694 | Aug 21, 2024 |
| tomcat-docs-webapp · RHEL 8 | 1:9.0.87-1.el8_10.2 | RHSA-2024:5694 | Aug 21, 2024 |
| tomcat-docs-webapp · RHEL 9 | 1:9.0.87-1.el9_4.2 | RHSA-2024:5693 | Aug 21, 2024 |
| tomcat-docs-webapp · almalinux 8 | 1:9.0.87-1.el8_10.2 | ALSA-2024:5694 | Aug 21, 2024 |
| tomcat-el-3.0-api · RHEL 8 | 1:9.0.87-1.el8_10.2 | RHSA-2024:5694 | Aug 21, 2024 |
| tomcat-el-3.0-api · RHEL 9 | 1:9.0.87-1.el9_4.2 | RHSA-2024:5693 | Aug 21, 2024 |
| tomcat-el-3.0-api · almalinux 8 | 1:9.0.87-1.el8_10.2 | ALSA-2024:5694 | Aug 21, 2024 |
| tomcat-jsp-2.3-api · RHEL 8 | 1:9.0.87-1.el8_10.2 | RHSA-2024:5694 | Aug 21, 2024 |
| tomcat-jsp-2.3-api · RHEL 9 | 1:9.0.87-1.el9_4.2 | RHSA-2024:5693 | Aug 21, 2024 |
| tomcat-jsp-2.3-api · almalinux 8 | 1:9.0.87-1.el8_10.2 | ALSA-2024:5694 | Aug 21, 2024 |
| tomcat-lib · RHEL 8 | 1:9.0.87-1.el8_10.2 | RHSA-2024:5694 | Aug 21, 2024 |
| tomcat-lib · RHEL 9 | 1:9.0.87-1.el9_4.2 | RHSA-2024:5693 | Aug 21, 2024 |
| tomcat-lib · almalinux 8 | 1:9.0.87-1.el8_10.2 | ALSA-2024:5694 | Aug 21, 2024 |
| tomcat-servlet-4.0-api · RHEL 8 | 1:9.0.87-1.el8_10.2 | RHSA-2024:5694 | Aug 21, 2024 |
| tomcat-servlet-4.0-api · RHEL 9 | 1:9.0.87-1.el9_4.2 | RHSA-2024:5693 | Aug 21, 2024 |
| tomcat-servlet-4.0-api · almalinux 8 | 1:9.0.87-1.el8_10.2 | ALSA-2024:5694 | Aug 21, 2024 |
| tomcat-webapps · RHEL 8 | 1:9.0.87-1.el8_10.2 | RHSA-2024:5694 | Aug 21, 2024 |
| tomcat-webapps · RHEL 9 | 1:9.0.87-1.el9_4.2 | RHSA-2024:5693 | Aug 21, 2024 |
| tomcat-webapps · almalinux 8 | 1:9.0.87-1.el8_10.2 | ALSA-2024:5694 | Aug 21, 2024 |
| tomcat10 · Debian 12.15 (bookworm) | 10.1.34-0+deb12u1 | DEBIAN-CVE-2024-38286 | Nov 7, 2024 |
| tomcat10 · Debian 13.5 (trixie) | 10.1.25-1 | DEBIAN-CVE-2024-38286 | Nov 7, 2024 |
| tomcat10 · Debian 14 | 10.1.25-1 | DEBIAN-CVE-2024-38286 | Nov 7, 2024 |
| tomcat10 · Ubuntu 24.04.5 LTS (noble) | 10.1.16-1ubuntu0.1~esm2 | tomcat10 10.1.16-1ubuntu0.1~esm2 | Nov 7, 2024 |
| tomcat10-admin · Ubuntu 24.04.5 LTS (noble) | 10.1.16-1ubuntu0.1~esm2 | tomcat10-admin 10.1.16-1ubuntu0.1~esm2 | Nov 7, 2024 |
| tomcat10-common · Ubuntu 24.04.5 LTS (noble) | 10.1.16-1ubuntu0.1~esm2 | tomcat10-common 10.1.16-1ubuntu0.1~esm2 | Nov 7, 2024 |
| tomcat10-docs · Ubuntu 24.04.5 LTS (noble) | 10.1.16-1ubuntu0.1~esm2 | tomcat10-docs 10.1.16-1ubuntu0.1~esm2 | Nov 7, 2024 |
| tomcat10-examples · Ubuntu 24.04.5 LTS (noble) | 10.1.16-1ubuntu0.1~esm2 | tomcat10-examples 10.1.16-1ubuntu0.1~esm2 | Nov 7, 2024 |
| tomcat10-user · Ubuntu 24.04.5 LTS (noble) | 10.1.16-1ubuntu0.1~esm2 | tomcat10-user 10.1.16-1ubuntu0.1~esm2 | Nov 7, 2024 |
| tomcat9 · Debian 12.15 (bookworm) | 9.0.70-2 | DEBIAN-CVE-2024-38286 | Nov 7, 2024 |
| tomcat9 · Debian 13.5 (trixie) | 9.0.70-2 | DEBIAN-CVE-2024-38286 | Nov 7, 2024 |
| tomcat9 · Debian 14 | 9.0.70-2 | DEBIAN-CVE-2024-38286 | Nov 7, 2024 |
| tomcat9 · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3ubuntu0.18.04.2+esm7 | tomcat9 9.0.16-3ubuntu0.18.04.2+esm7 | Nov 7, 2024 |
| tomcat9 · Ubuntu 20.04 LTS (focal) | 9.0.31-1ubuntu0.9+esm2 | tomcat9 9.0.31-1ubuntu0.9+esm2 | Nov 7, 2024 |
| tomcat9 · Ubuntu 22.04.1 LTS (jammy) | 9.0.58-1ubuntu0.2+esm3 | tomcat9 9.0.58-1ubuntu0.2+esm3 | Nov 7, 2024 |
| tomcat9-admin · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3ubuntu0.18.04.2+esm7 | tomcat9-admin 9.0.16-3ubuntu0.18.04.2+esm7 | Nov 7, 2024 |
| tomcat9-admin · Ubuntu 20.04 LTS (focal) | 9.0.31-1ubuntu0.9+esm2 | tomcat9-admin 9.0.31-1ubuntu0.9+esm2 | Nov 7, 2024 |
| tomcat9-admin · Ubuntu 22.04.1 LTS (jammy) | 9.0.58-1ubuntu0.2+esm3 | tomcat9-admin 9.0.58-1ubuntu0.2+esm3 | Nov 7, 2024 |
| tomcat9-common · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3ubuntu0.18.04.2+esm7 | tomcat9-common 9.0.16-3ubuntu0.18.04.2+esm7 | Nov 7, 2024 |
| tomcat9-common · Ubuntu 20.04 LTS (focal) | 9.0.31-1ubuntu0.9+esm2 | tomcat9-common 9.0.31-1ubuntu0.9+esm2 | Nov 7, 2024 |
| tomcat9-common · Ubuntu 22.04.1 LTS (jammy) | 9.0.58-1ubuntu0.2+esm3 | tomcat9-common 9.0.58-1ubuntu0.2+esm3 | Nov 7, 2024 |
| tomcat9-docs · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3ubuntu0.18.04.2+esm7 | tomcat9-docs 9.0.16-3ubuntu0.18.04.2+esm7 | Nov 7, 2024 |
| tomcat9-docs · Ubuntu 20.04 LTS (focal) | 9.0.31-1ubuntu0.9+esm2 | tomcat9-docs 9.0.31-1ubuntu0.9+esm2 | Nov 7, 2024 |
| tomcat9-docs · Ubuntu 22.04.1 LTS (jammy) | 9.0.58-1ubuntu0.2+esm3 | tomcat9-docs 9.0.58-1ubuntu0.2+esm3 | Nov 7, 2024 |
| tomcat9-examples · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3ubuntu0.18.04.2+esm7 | tomcat9-examples 9.0.16-3ubuntu0.18.04.2+esm7 | Nov 7, 2024 |
| tomcat9-examples · Ubuntu 20.04 LTS (focal) | 9.0.31-1ubuntu0.9+esm2 | tomcat9-examples 9.0.31-1ubuntu0.9+esm2 | Nov 7, 2024 |
| tomcat9-examples · Ubuntu 22.04.1 LTS (jammy) | 9.0.58-1ubuntu0.2+esm3 | tomcat9-examples 9.0.58-1ubuntu0.2+esm3 | Nov 7, 2024 |
| tomcat9-user · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3ubuntu0.18.04.2+esm7 | tomcat9-user 9.0.16-3ubuntu0.18.04.2+esm7 | Nov 7, 2024 |
| tomcat9-user · Ubuntu 20.04 LTS (focal) | 9.0.31-1ubuntu0.9+esm2 | tomcat9-user 9.0.31-1ubuntu0.9+esm2 | Nov 7, 2024 |
| tomcat9-user · Ubuntu 22.04.1 LTS (jammy) | 9.0.58-1ubuntu0.2+esm3 | tomcat9-user 9.0.58-1ubuntu0.2+esm3 | Nov 7, 2024 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.