Apache Tomcat 9.0.0.M1 < 9.0.86 multiple vulnerabilities

This Tenable plugin bundles two denial-of-service vulnerabilities in Apache Tomcat 9.0.0-M1 through 9.0.85, both fixed in 9.0.86. CVE-2024-24549 (CVSS 7.5) allows an unauthenticated attacker to send HTTP/2 requests with oversized headers; Tomcat fails to reset the stream until *after* processing all headers, consuming excessive CPU and memory. CVE-2024-23672 (CVSS ~6.3) lets a WebSocket client hold connections open indefinitely, exhausting server resources. Both were discovered by or reported to the Tomcat Security Team in January 2024 and publicly disclosed on March 13, 2024. Affected branches include Tomcat 8.x (<8.5.99), 9.x (<9.0.86), 10.x (<10.1.19), and 11.x (<11.0.0-M17).

The vendor (Apache) rates both as Important, and the highest NVD CVSS base score is 7.5 — placing it at the top of the MEDIUM / bottom of HIGH range. Tenable's own VPR score of 3.0 (Low) already signals that the real-world risk is lower than the CVSS face value. That's the right instinct: these are availability-only impacts with zero confidentiality or integrity consequences. An attacker can make your Tomcat instance sluggish or unresponsive, but they cannot execute code, read data, or pivot deeper into your network. For most enterprises, a Tomcat restart resolves the condition.

Why this verdict

• Impact ceiling is availability-only. Both CVEs have C:N/I:N in their CVSS vectors. No code execution, no data exfiltration, no credential theft. The worst outcome is a temporary outage on the targeted Tomcat instance, recoverable by restart.
• Tenable's own VPR confirms low real-world risk. Tenable's Vulnerability Priority Rating is 3.0 (Low), despite the CVSS 7.5 base score. VPR factors in exploit maturity and threat context — both agree this is not an urgent risk.
• Reverse proxy friction reduces reachable population. CVE-2024-24549 requires HTTP/2 to reach Tomcat directly. In most enterprise deployments, a reverse proxy (nginx, HAProxy, F5, cloud ALB) terminates HTTP/2 before it hits Tomcat, meaning the vulnerable code path is never exercised. This narrows the exposed population significantly.
• No active exploitation or KEV listing. Neither CVE is in CISA KEV. No ransomware campaigns, APT groups, or incident reports reference these vulnerabilities. The high EPSS for CVE-2024-24549 (23%) reflects ease of triggering, not observed exploitation.
• Role multiplier: Tomcat as application server. Tomcat's canonical role is a line-of-business application tier — not an identity provider, domain controller, hypervisor, or backup server. Even in high-value deployments (e.g., Tomcat hosting a payment gateway), DoS impact is bounded to service disruption, not data breach or fleet compromise. Load-balanced and auto-scaled deployments further limit blast radius. The DoS-only impact means no high-value-role floor applies — even on a critical Tomcat instance, the chain never reaches domain takeover, data exfiltration, or supply-chain pivot.

Why not higher?

A HIGH rating would require either active exploitation evidence, a path to code execution / data compromise, or a blast radius beyond a single service. None of these conditions are met. The attack is a recoverable DoS with no persistence, no lateral movement capability, and no confidentiality/integrity impact. The high EPSS score reflects exploit simplicity, not severity of outcome.

Why not lower?

A LOW or IGNORE rating would undercount the unauthenticated, network-reachable attack vector of CVE-2024-24549 and its high EPSS (97th percentile). While the impact is limited to availability, an unmitigated internet-facing Tomcat with HTTP/2 directly exposed could experience real service disruption. The breadth of affected versions (every 9.x milestone release) also argues against dismissing it entirely.

1. Terminate HTTP/2 at the reverse proxy, not at Tomcat — Configure your load balancer or reverse proxy (nginx, HAProxy, F5, AWS ALB) to accept HTTP/2 from clients and proxy to Tomcat over HTTP/1.1. This eliminates CVE-2024-24549's attack surface entirely. Most enterprise deployments already do this. Verify within the noisgate 365-day remediation window.
2. Enforce WebSocket idle timeouts upstream — Set proxy_read_timeout (nginx) or equivalent to 300s or less for WebSocket connections. This prevents CVE-2024-23672's slow-drain resource exhaustion. The reverse proxy will close idle connections before they can accumulate.
3. Tune Tomcat connector limits — In server.xml, set maxHeaderCount="100", maxHeaderSize="8192", and maxConcurrentStreams="100" on the HTTP/2 connector. Also set maxConnections and connectionTimeout to bound total resource consumption. These don't fix the bug but reduce the amplification factor.
4. Enable health-check-based auto-restart — If running in Kubernetes, ECS, or behind a load balancer, ensure HTTP health probes will detect unresponsive Tomcat instances and trigger automatic restart/replacement. This limits DoS impact to seconds rather than minutes.

Run this on each Tomcat host (or from a central auditor workstation with SSH access). Invoke with: bash check_tomcat_cve.sh /opt/tomcat (pass the Tomcat installation directory as the first argument). Requires read access to the Tomcat lib/ directory. No root required.

#!/usr/bin/env bash
# check_tomcat_cve.sh — Verify Apache Tomcat against CVE-2024-24549 / CVE-2024-23672
# Usage: bash check_tomcat_cve.sh /path/to/tomcat
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

TOMCAT_HOME="${1:-}"

if [[ -z "$TOMCAT_HOME" ]]; then
  echo "Usage: $0 /path/to/tomcat"
  exit 2
fi

# Try catalina.jar for version info
CATALINA_JAR="$TOMCAT_HOME/lib/catalina.jar"
if [[ ! -f "$CATALINA_JAR" ]]; then
  # Try alternate locations
  CATALINA_JAR="$TOMCAT_HOME/server/lib/catalina.jar"
fi

if [[ ! -f "$CATALINA_JAR" ]]; then
  echo "UNKNOWN — Cannot find catalina.jar in $TOMCAT_HOME"
  exit 2
fi

# Extract version from MANIFEST.MF or ServerInfo.properties
VERSION=$(unzip -p "$CATALINA_JAR" org/apache/catalina/util/ServerInfo.properties 2>/dev/null \
  | grep 'server.number' | cut -d'=' -f2 | tr -d '[:space:]')

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not determine Tomcat version from $CATALINA_JAR"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Check Tomcat 9.x branch: vulnerable if < 9.0.86
if [[ "$MAJOR" -eq 9 ]]; then
  if [[ "$MINOR" -eq 0 && "$PATCH" -lt 86 ]]; then
    echo "VULNERABLE — Tomcat $VERSION is affected by CVE-2024-24549 and CVE-2024-23672 (fixed in 9.0.86)"
    exit 1
  else
    echo "PATCHED — Tomcat $VERSION is >= 9.0.86"
    exit 0
  fi
# Check Tomcat 8.5.x branch: vulnerable if < 8.5.99
elif [[ "$MAJOR" -eq 8 && "$MINOR" -eq 5 ]]; then
  if [[ "$PATCH" -lt 99 ]]; then
    echo "VULNERABLE — Tomcat $VERSION is affected (fixed in 8.5.99)"
    exit 1
  else
    echo "PATCHED — Tomcat $VERSION is >= 8.5.99"
    exit 0
  fi
# Check Tomcat 10.1.x branch: vulnerable if < 10.1.19
elif [[ "$MAJOR" -eq 10 && "$MINOR" -eq 1 ]]; then
  if [[ "$PATCH" -lt 19 ]]; then
    echo "VULNERABLE — Tomcat $VERSION is affected (fixed in 10.1.19)"
    exit 1
  else
    echo "PATCHED — Tomcat $VERSION is >= 10.1.19"
    exit 0
  fi
# Check Tomcat 11.x: vulnerable if < 11.0.0-M17 (simplified: any 11.0.0 milestone)
elif [[ "$MAJOR" -eq 11 ]]; then
  echo "UNKNOWN — Tomcat 11.x detected ($VERSION). Manually verify >= 11.0.0-M17."
  exit 2
else
  echo "UNKNOWN — Unexpected Tomcat version: $VERSION"
  exit 2
fi

Sources

1. Tenable Plugin 192042
2. Apache Tomcat 9.x Security Advisories
3. NVD — CVE-2024-24549
4. NVD — CVE-2024-23672
5. Aqua Security — CVE-2024-24549
6. FIRST EPSS API
7. CISA KEV Catalog
8. Tomitribe — Tomcat 9.0.86 CVE Patching