Read the docs
TI-2024-14419 Aliases CVE-2024-21733GHSA-f4qf-m5gf-8jm8

Apache Tomcat: Leaking of unrelated request bodies in default error page

Priority LOW 39CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.

Summary

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.14286 96th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat-coyote (Maven): 9.0.44, 8.5.64org.apache.tomcat.embed:tomcat-embed-core (Maven): 8.5.64, 9.0.44+1 more productRed Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat8.5.7 – 8.5.63; 9.0.0-M11 – 9.0.43—No fix listedCNA
—org.apache.tomcat:tomcat-coyote (Maven)9.0.0-M11 to before 9.0.449.0.44Patch availableGHSA-f4qf-m5gf-8jm8
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.5.7 to before 8.5.648.5.64Patch availableGHSA-f4qf-m5gf-8jm8
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.0-M11 to before 9.0.449.0.44Patch availableGHSA-f4qf-m5gf-8jm8
—org.apache.tomcat:tomcat-coyote (Maven)8.5.7 to before 8.5.648.5.64Patch availableGHSA-f4qf-m5gf-8jm8
—org.apache.tomcat.experimental:tomcat-embed-programmatic (Maven)9.0.43 to before 9.0.449.0.44Patch availableGHSA-f4qf-m5gf-8jm8
  • Apache Tomcat VendorApache Affected 8.5.7 – 8.5.63; 9.0.0-M11 – 9.0.43 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 9.0.0-M11 to before 9.0.44 Fixed in 9.0.44 Patch available GHSA-f4qf-m5gf-8jm8
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.7 to before 8.5.64 Fixed in 8.5.64 Patch available GHSA-f4qf-m5gf-8jm8
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0-M11 to before 9.0.44 Fixed in 9.0.44 Patch available GHSA-f4qf-m5gf-8jm8
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.5.7 to before 8.5.64 Fixed in 8.5.64 Patch available GHSA-f4qf-m5gf-8jm8
  • org.apache.tomcat.experimental:tomcat-embed-programmatic (Maven) Vendor— Affected 9.0.43 to before 9.0.44 Fixed in 9.0.44 Patch available GHSA-f4qf-m5gf-8jm8

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*8.5.7 to before 8.5.64; 9.0.1 to before 9.0.44VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*9.0.0 milestone11VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*9.0.0 milestone12VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*9.0.0 milestone13VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*9.0.0 milestone14VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*9.0.0 milestone15VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*9.0.0 milestone16VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*9.0.0 milestone17VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*9.0.0 milestone18VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*9.0.0 milestone19VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.7 to before 8.5.64; 9.0.1 to before 9.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*9.0.0 milestone20VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*9.0.0 milestone21VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*9.0.0 milestone22VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*9.0.0 milestone23VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*9.0.0 milestone24VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*9.0.0 milestone25VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*9.0.0 milestone26VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*9.0.0 milestone27VulnerableApache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache

Remediation

  • Fix · GHSA-f4qf-m5gf-8jm8 org.apache.tomcat:tomcat-coyote (Maven) Fixed in 9.0.44 Advisory →
  • Fix · GHSA-f4qf-m5gf-8jm8 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.64 Advisory →
  • Fix · GHSA-f4qf-m5gf-8jm8 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.44 Advisory →
  • Fix · GHSA-f4qf-m5gf-8jm8 org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.5.64 Advisory →
  • Fix · GHSA-f4qf-m5gf-8jm8 org.apache.tomcat.experimental:tomcat-embed-programmatic (Maven) Fixed in 9.0.44 Advisory →

Red Hat 2 advisories

  • RHSA-2024:3354 Released 2024-05-23 · Red Hat rating Important
    Red Hat Fuse 7.13.0 release and security update
    • Red Hat Fuse 7.13.0
  • RHSA-2024:2707 Released 2024-05-06 · Red Hat rating Important
    Red Hat Build of Apache Camel security update
    • Red Hat build of Apache Camel 4.4.0 for Spring Boot

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7.13.0Fixed RHSA-2024:3354
Red Hat build of Apache Camel 4.4.0 for Spring BootFixed RHSA-2024:2707
Not affected: 23 products
  • A-MQ Clients 2
  • Red Hat AMQ Broker 7
  • Red Hat Build of Keycloak
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 5
  • Red Hat JBoss Web Server 6
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of OptaPlanner 8
  • Red Hat support for Spring Boot
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21733
  2. 2026-10-03 Alias added: GHSA-f4qf-m5gf-8jm8

References

Patch 2

Advisory 1

Other 8

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences