Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.
Older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat | May 29, 2024 | Mar 13, 2024 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webapps | Apr 18, 2024 | Mar 13, 2024 |
| Amazon_linux | — | Upgrade tomcat8 | Jun 24, 2024 | Mar 13, 2024 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 10.1.19Upgrade Apache Tomcat to 8.5.99Upgrade Apache Tomcat to 9.0.86Upgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to the latest available version | Mar 14, 2024 | Mar 13, 2024 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | May 21, 2024 |
| Debian | — | Upgrade tomcat9Upgrade tomcat10 | Apr 8, 2024 | Mar 13, 2024 |
| Oracle_linux | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-webapps | May 24, 2024 | Mar 13, 2024 |
| Redhat_linux | — | Upgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiNo solution existsUpgrade tomcat-webappsUpgrade tomcat-lib | May 24, 2024 | Mar 13, 2024 |
| Suse | — | Upgrade geronimo-jsp-2_0-apiUpgrade tomcat-servlet-4_0-apiUpgrade geronimo-j2ee-connector-1_5-apiUpgrade geronimo-jaf-1_0_2-apiUpgrade geronimo-j2ee-management-1_1-apiUpgrade tomcat10-embedUpgrade tomcat-el-3_0-apiUpgrade geronimo-ws-metadata-2_0-apiUpgrade geronimo-saaj-1_1-apiUpgrade geronimo-javamail-1_4-apiUpgrade geronimo-el-1_0-apiUpgrade geronimo-jta-1_1-apiUpgrade apache-commons-dbcpUpgrade apache-commons-dbcp-javadocUpgrade tomcat-libUpgrade tomcat10-servlet-6_0-apiUpgrade tomcat10-docUpgrade tomcat10-docs-webappUpgrade tomcat-javadocUpgrade geronimo-j2ee-deployment-1_1-apiUpgrade geronimo-commonj-1_1-apisUpgrade geronimo-qname-1_1-apiUpgrade geronimo-jsp-2_1-apiUpgrade jakarta-taglibs-standardUpgrade apache-commons-pool2Upgrade geronimo-annotation-1_0-apiUpgrade geronimo-j2ee-1_4-apisUpgrade geronimo-j2ee-management-1_0-apiUpgrade tomcat-admin-webappsUpgrade geronimo-ejb-2_1-apiUpgrade geronimo-servlet-2_4-apiUpgrade tomcat10-webappsUpgrade geronimo-jpa-3_0-apiUpgrade geronimo-interceptor-3_0-apiUpgrade tomcat10Upgrade tomcat-jsp-2_3-apiUpgrade tomcatUpgrade tomcat10-el-5_0-apiUpgrade tomcat-webappsUpgrade geronimo-jaf-1_1-apiUpgrade jakarta-taglibs-standard-javadocUpgrade apache-commons-daemonUpgrade geronimo-corba-2_3-apisUpgrade tomcat10-admin-webappsUpgrade geronimo-jaxrpc-1_1-apiUpgrade geronimo-stax-1_0-apiUpgrade geronimo-jacc-1_0-apiUpgrade geronimo-javamail-1_3_1-apiUpgrade geronimo-corba-1_0-apisUpgrade apache-commons-daemon-javadocUpgrade tomcat10-libUpgrade tomcat10-jsvcUpgrade tomcat-docs-webappUpgrade geronimo-servlet-2_5-apiUpgrade geronimo-jms-1_1-apiUpgrade geronimo-ejb-3_0-apiUpgrade tomcat-embedUpgrade geronimo-javaee-deployment-1_1-apiUpgrade geronimo-jacc-1_1-apiUpgrade tomcat-jsvcUpgrade apache-commons-daemon-jsvcUpgrade tomcat10-jsp-3_1-apiUpgrade apache-commons-pool2-javadocUpgrade geronimo-jaxr-1_0-apiUpgrade geronimo-jta-1_0_1B-api | Apr 12, 2024 | Mar 13, 2024 |
| Ubuntu | — | Upgrade libtomcat10-java (Ubuntu Pro)Upgrade libtomcat9-java (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro)Upgrade tomcat10 (Ubuntu Pro)Upgrade tomcat8 (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro)Upgrade libtomcat9-javaUpgrade tomcat9 | Nov 19, 2024 | Mar 13, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 13, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub