CVE-2024-24549

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-24555.4The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t CVE-2024-245508.1A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through CVE-2024-245518.8A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. Th CVE-2024-245528.8A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or an CVE-2024-245537.5Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force att CVE-2024-245548.2Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the use CVE-2024-245566.1urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit th CVE-2024-245577.8Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poi CVE-2024-245586.1TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-nex CVE-2024-245595.3Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Co CVE-2024-24566.4The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all ver CVE-2024-245605.3Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input