{"id":"CVE-2024-52317","published":"2024-11-18T11:36:51Z","modified":"2025-01-24T20:03:10Z","title":"Apache Tomcat: Request/response mix-up with HTTP/2","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests \ncould lead to request and/or response mix-up between users.\n\nThis issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.02097,"percentile":0.81655,"provenance":"source"},"cwes":[{"id":"CWE-326","name":"Inadequate Encryption Strength"}],"references":[{"url":"https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/11/18/3","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250124-0004/","tags":[]}],"priority":{"score":25.9,"factors":[{"name":"EPSS percentile","points":16.33},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":4.55}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-11-21","earliestUrl":"https://github.com/TAM-K592/CVE-2024-52317","repos":[{"name":"TAM-K592/CVE-2024-52317","url":"https://github.com/TAM-K592/CVE-2024-52317","stars":4,"created":"2024-11-21"}]},"first":{"date":"2024-11-21","source":"PoC-in-GitHub","url":"https://github.com/TAM-K592/CVE-2024-52317"},"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[">= 11.0.0-M23, <= 11.0.0-M26",">= 10.1.27, <= 10.1.30",">= 9.0.92, <= 9.0.95"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.92, <9.0.96",">=10.1.27, <10.1.31",">=11.0.0-M23, <11.0.0"],"patched":["9.0.96","10.1.31","11.0.0"],"from":["GHSA-qvf5-hvjx-wm27"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=9.0.92, <9.0.96",">=10.1.27, <10.1.31",">=11.0.0-M23, <11.0.0"],"patched":["9.0.96","10.1.31","11.0.0"],"from":["GHSA-qvf5-hvjx-wm27"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3305","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-7675","parents":[{"from":"CVE-2024-34750","to":"CVE-2024-52317","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Stream.java"],"commits":["https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2","https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3","https://github.com/apache/tomcat/commit/146f94f87ea398fb592c7a20a5ccbef95e9dd72b","https://github.com/apache/tomcat/commit/47307ee27abcdea2ee40e33897aca760083de46a"],"basis":"shared function","functions":["Stream"]}]}],"packageHistory":[{"cve":"CVE-2023-34981","published":"2023-06-21","fixed":"8.5.89","kev":false,"link":{"from":"CVE-2023-34981","to":"CVE-2024-52317","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"11.0.0-M6","toFixed":"11.0.0","daysApart":516}]}},{"cve":"CVE-2024-34750","published":"2024-07-03","fixed":"11.0.0-M21","kev":false},{"cve":"CVE-2024-38286","published":"2024-11-07","fixed":"11.0.0-M21","kev":false},{"cve":"CVE-2023-24998","published":"2023-02-20","fixed":"11.0.0-M5","kev":false,"link":{"from":"CVE-2023-24998","to":"CVE-2024-52317","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"11.0.0-M5","toFixed":"11.0.0","daysApart":637}]}},{"cve":"CVE-2024-52317","published":"2024-11-18","fixed":"11.0.0","kev":false},{"cve":"CVE-2025-31650","published":"2025-04-28","fixed":"11.0.6","kev":false,"link":{"from":"CVE-2024-52317","to":"CVE-2025-31650","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.96","toFixed":"9.0.104","daysApart":161},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"10.1.31","toFixed":"10.1.40","daysApart":161},{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http2/Stream.java"],"commits":["https://github.com/apache/tomcat/commit/146f94f87ea398fb592c7a20a5ccbef95e9dd72b","https://github.com/apache/tomcat/commit/47307ee27abcdea2ee40e33897aca760083de46a","https://github.com/apache/tomcat/commit/1eef1dc459c45f1e421d8bd25ef340fc1cc34edc","https://github.com/apache/tomcat/commit/40ae788c2e64d018b4e58cd4210bb96434d0100d"],"basis":"shared file"}]}},{"cve":"CVE-2025-53506","published":"2025-07-10","fixed":"11.0.9","kev":false},{"cve":"CVE-2025-48989","published":"2025-08-13","fixed":"11.0.10","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-coyote"}}