Read the docs
TI-2024-33814 Aliases CVE-2024-50379GHSA-5j33-cvvr-w245

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

Priority HIGH 82CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 13 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.31824 98th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat-catalina (Maven): 11.0.2, 10.1.34, 9.0.98org.apache.tomcat.embed:tomcat-embed-core (Maven): 11.0.2, 10.1.34, 9.0.98Red Hat: 11 advisoriesRed Hat: 13 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat11.0.0-M1 – 11.0.1; 10.1.0-M1 – 10.1.33; 9.0.0.M1 – 9.0.97; 8.5.0 – 8.5.100—No fix listedCNA
—org.apache.tomcat:tomcat-catalina (Maven)11.0.0-M1 to before 11.0.211.0.2Patch availableGHSA-5j33-cvvr-w245
—org.apache.tomcat:tomcat-catalina (Maven)10.1.0-M1 to before 10.1.3410.1.34Patch availableGHSA-5j33-cvvr-w245
—org.apache.tomcat:tomcat-catalina (Maven)9.0.0.M1 to before 9.0.989.0.98Patch availableGHSA-5j33-cvvr-w245
—org.apache.tomcat.embed:tomcat-embed-core (Maven)11.0.0-M1 to before 11.0.211.0.2Patch availableGHSA-5j33-cvvr-w245
—org.apache.tomcat.embed:tomcat-embed-core (Maven)10.1.0-M1 to before 10.1.3410.1.34Patch availableGHSA-5j33-cvvr-w245
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.0.M1 to before 9.0.989.0.98Patch availableGHSA-5j33-cvvr-w245
—org.apache.tomcat:tomcat-catalina (Maven)8.5.0 – 8.5.100—No fix listedGHSA-5j33-cvvr-w245
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.5.0 – 8.5.100—No fix listedGHSA-5j33-cvvr-w245
  • Apache Tomcat VendorApache Affected 11.0.0-M1 – 11.0.1; 10.1.0-M1 – 10.1.33; 9.0.0.M1 – 9.0.97; 8.5.0 – 8.5.100 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 11.0.0-M1 to before 11.0.2 Fixed in 11.0.2 Patch available GHSA-5j33-cvvr-w245
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.34 Fixed in 10.1.34 Patch available GHSA-5j33-cvvr-w245
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.98 Fixed in 9.0.98 Patch available GHSA-5j33-cvvr-w245
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 11.0.0-M1 to before 11.0.2 Fixed in 11.0.2 Patch available GHSA-5j33-cvvr-w245
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.34 Fixed in 10.1.34 Patch available GHSA-5j33-cvvr-w245
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.98 Fixed in 9.0.98 Patch available GHSA-5j33-cvvr-w245
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.5.0 – 8.5.100 Fixed in — No fix listed GHSA-5j33-cvvr-w245
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.0 – 8.5.100 Fixed in — No fix listed GHSA-5j33-cvvr-w245

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*9.0.0 to before 9.0.98; 10.1.0 to before 10.1.34; 11.0.0 to before 11.0.2VulnerableApache
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.0.98; 10.1.0 to before 10.1.34; 11.0.0 to before 11.0.2 Vulnerable ·Apache
  • cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp

Remediation

  • Fix · GHSA-5j33-cvvr-w245 org.apache.tomcat:tomcat-catalina (Maven) Fixed in 11.0.2 Advisory →
  • Fix · GHSA-5j33-cvvr-w245 org.apache.tomcat:tomcat-catalina (Maven) Fixed in 10.1.34 Advisory →
  • Fix · GHSA-5j33-cvvr-w245 org.apache.tomcat:tomcat-catalina (Maven) Fixed in 9.0.98 Advisory →
  • Fix · GHSA-5j33-cvvr-w245 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 11.0.2 Advisory →
  • Fix · GHSA-5j33-cvvr-w245 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.1.34 Advisory →
  • Fix · GHSA-5j33-cvvr-w245 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.98 Advisory →

Red Hat 11 advisories

  • RHSA-2025:11332 Released 2025-07-16 · Red Hat rating Important
    tomcat9 security update
    • Red Hat Enterprise Linux AppStream (v. 10) tomcat9-1:9.0.87-5.el10_0.1, tomcat9-admin-webapps-1:9.0.87-5.el10_0.1, tomcat9-docs-webapp-1:9.0.87-5.el10_0.1 +5
  • RHSA-2025:3684 Released 2025-04-08 · Red Hat rating Moderate
    tomcat security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat-1:9.0.87-1.el8_8.4, tomcat-admin-webapps-1:9.0.87-1.el8_8.4, tomcat-docs-webapp-1:9.0.87-1.el8_8.4 +5
  • RHSA-2025:3683 Released 2025-04-08 · Red Hat rating Moderate
    tomcat security update
    • Red Hat Enterprise Linux AppStream (v. 8) tomcat-1:9.0.87-1.el8_10.3, tomcat-admin-webapps-1:9.0.87-1.el8_10.3, tomcat-docs-webapp-1:9.0.87-1.el8_10.3 +5
Show 8 more Red Hat advisories
  • RHSA-2025:3647 Released 2025-04-07 · Red Hat rating Moderate
    tomcat security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) tomcat-1:9.0.87-1.el9_4.3, tomcat-admin-webapps-1:9.0.87-1.el9_4.3, tomcat-docs-webapp-1:9.0.87-1.el9_4.3 +5
  • RHSA-2025:3646 Released 2025-04-07 · Red Hat rating Moderate
    tomcat security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) tomcat-1:9.0.87-1.el9_2.3, tomcat-admin-webapps-1:9.0.87-1.el9_2.3, tomcat-docs-webapp-1:9.0.87-1.el9_2.3 +5
  • RHSA-2025:3645 Released 2025-04-07 · Red Hat rating Moderate
    tomcat security update
    • Red Hat Enterprise Linux AppStream (v. 9) tomcat-1:9.0.87-2.el9_5.1, tomcat-admin-webapps-1:9.0.87-2.el9_5.1, tomcat-docs-webapp-1:9.0.87-2.el9_5.1 +5
  • RHSA-2025:1920 Released 2025-02-27 · Red Hat rating Moderate
    pki-servlet-engine security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) pki-servlet-4.0-api-1:9.0.50-1.el9_2.2, pki-servlet-engine-1:9.0.50-1.el9_2.2
  • RHSA-2025:0343 Released 2025-01-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 6.0.5 release and security update
    • Red Hat JBoss Web Server 6
  • RHSA-2025:0342 Released 2025-01-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 6.0.5 release and security update
    • Red Hat JBoss Web Server 6.0 for RHEL 8 jws6-tomcat-10.1.8-15.redhat_00022.1.el8jws, jws6-tomcat-admin-webapps-10.1.8-15.redhat_00022.1.el8jws, jws6-tomcat-docs-webapp-10.1.8-15.redhat_00022.1.el8jws +7
    • Red Hat JBoss Web Server 6.0 for RHEL 9 jws6-tomcat-10.1.8-15.redhat_00022.1.el9jws, jws6-tomcat-admin-webapps-10.1.8-15.redhat_00022.1.el9jws, jws6-tomcat-docs-webapp-10.1.8-15.redhat_00022.1.el9jws +7
  • RHSA-2025:0362 Released 2025-01-16 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.8.2 release and security update
    • Red Hat JBoss Web Server 5
  • RHSA-2025:0361 Released 2025-01-16 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.8.2 release and security update
    • Red Hat JBoss Web Server 5.8 for RHEL 7 Server jws5-tomcat-9.0.87-6.redhat_00006.1.el7jws, jws5-tomcat-admin-webapps-9.0.87-6.redhat_00006.1.el7jws, jws5-tomcat-docs-webapp-9.0.87-6.redhat_00006.1.el7jws +9
    • Red Hat JBoss Web Server 5.8 for RHEL 8 jws5-tomcat-9.0.87-6.redhat_00006.1.el8jws, jws5-tomcat-admin-webapps-9.0.87-6.redhat_00006.1.el8jws, jws5-tomcat-docs-webapp-9.0.87-6.redhat_00006.1.el8jws +7
    • Red Hat JBoss Web Server 5.8 for RHEL 9 jws5-tomcat-9.0.87-6.redhat_00006.1.el9jws, jws5-tomcat-admin-webapps-9.0.87-6.redhat_00006.1.el9jws, jws5-tomcat-docs-webapp-9.0.87-6.redhat_00006.1.el9jws +7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Tomcat 8.5.0

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2024-36640 Apache Tomcat: DoS in examples web applicationPriority LOW 34
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:11332
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:3683
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:3645
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2025:3684
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2025:1920, RHSA-2025:3646
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:3647
Red Hat JBoss Web Server 5Fixed RHSA-2025:0362
Red Hat JBoss Web Server 5.8 for RHEL 7 ServerFixed RHSA-2025:0361
Red Hat JBoss Web Server 5.8 for RHEL 8Fixed RHSA-2025:0361
Red Hat JBoss Web Server 5.8 for RHEL 9Fixed RHSA-2025:0361
Red Hat JBoss Web Server 6Fixed RHSA-2025:0343
Red Hat JBoss Web Server 6.0 for RHEL 8Fixed RHSA-2025:0342
Red Hat JBoss Web Server 6.0 for RHEL 9Fixed RHSA-2025:0342
Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-50379
  2. 2026-10-03 Alias added: GHSA-5j33-cvvr-w245
  3. 2026-10-09 Fix available: RHSA-2025:0343 · Red Hat
  4. 2026-11-03 CISA SSVC decision points changed
  5. 2026-11-04 Fix available: Red Hat JBoss Web Server 6 · Red Hat

References

Advisory 3

Other 14

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences