CVE-2024-54677: Apache Tomcat Remote Code Execution Vulnerability

MODERATE
Advisory Identifier: GHSA-653p-vg55-5652
Share
CVSS 5.3
CWE-400
Published
Advisory Summary

CVE-2024-54677 is a MODERATE (CVSS 5.3) remote code execution vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Apache Tomcat libraries in the Maven ecosystem. The issue involves apache tomcat uncontrolled resource consumption vulnerability. Remediation is available by upgrading affected packages to version 11.0.2, 10.1.34, 9.0.98.

CVE-2024-54677 at a Glance

CVE Identifier CVE-2024-54677
GHSA Identifier GHSA-653p-vg55-5652
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-400: Uncontrolled Resource Consumption
Affected Product Apache Tomcat
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability Low (A:L)

How to Fix CVE-2024-54677

To remediate this vulnerability, upgrade all affected Apache Tomcat dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.tomcat:tomcat fixed: 11.0.2 
<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat</artifactId>
    <version>11.0.2</version>
</dependency>
org.apache.tomcat:tomcat fixed: 10.1.34 
<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat</artifactId>
    <version>10.1.34</version>
</dependency>
org.apache.tomcat:tomcat fixed: 9.0.98 
<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat</artifactId>
    <version>9.0.98</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.apache.tomcat

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2024-54677, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.tomcat

Analyze the terminal output to locate any version of Apache Tomcat in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 11.0.2), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.tomcat command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Apache Tomcat, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue. This vulnerability does not affect core Apache Tomcat server components (tomcat-catalina, tomcat-coyote, tomcat-embed-core, etc.). Removing the `webapps/examples/` directory in production environments — as recommended by the [Apache Tomcat Security Considerations documentation](https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Examples) — eliminates the attack surface entirely.

CVE-2024-54677 Affected Apache Tomcat Versions

3 component(s)
Fixed Versions:
11.0.210.1.349.0.98
Product / Package Ecosystem Affected Versions Fixed Version
org.apache.tomcat:tomcat
maven/org.apache.tomcat/tomcat
Maven
≥ 11.0.0-M1
< 11.0.2
11.0.2
org.apache.tomcat:tomcat
maven/org.apache.tomcat/tomcat
Maven
≥ 10.1.0-M1
< 10.1.34
10.1.34
org.apache.tomcat:tomcat
maven/org.apache.tomcat/tomcat
Maven
≥ 9.0.0.M1
< 9.0.98
9.0.98

References

NVD — CVE-2024-54677 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-54677
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/f57a9d9847c1038be61f5818d73b8be907c460d4
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/e8c16cdba833884e1bd49fff1f1cb699da177585
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/dbec927859d9484cb8bd680a7c67b1a560f48444
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/d63a10afc142b12f462a15f7d10f79fd80ff94eb
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/cb1707685472994e9d924746f8c91cb116fa5213
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/c2f7ce21c3fb12caefee87c517a8bb4f80700044
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/c0a23927ea5e061ca3fdff695138464179fe674a
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/bbd82e9593314ade4cfd57248f9285fbad686f66
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/aa5b4d0043289cf054f531ec55126c980d3572e1
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/a95bf2b0303442a2c9a1ac364b0e63b56049e33a
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/9ffd23fc27f5d1fc95bf97e5cea175c8968f4533
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/84c4af76e7a10fc7f8630ce62e6a46632ea4a90e
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/84065e26ca4555e63a922bb29b13b0a1c86b7654
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/75ff7e8622edcc024b268677aa789ee8f0880ecc
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/722814668708c42a61b0c1e340b15bc2b785c0d1
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/721544ea28e92549824b106be954a9f411867a1c
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/54e56495e9a106218efe9fc9c79d976c0032bbfd
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/4f0236606961176257b883213e1621b1859ed746
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/4d5cc6538d91386f950373ac8120e98c2c78ed3a
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/4a335c6dcba8d6f8a54629eda392a50da267bdf4
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/3315a9027a7eaab18f42625b97b569940ff1365d
Security Fix Commit FIX COMMIT
https://github.com/apache/tomcat/commit/1d88dd3ffaed76188dd4ee32ce77709ce6e153cd
Apache Tomcat Security Information SECURITY
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.34
Apache Tomcat Security Information SECURITY
https://security.netapp.com/advisory/ntap-20250131-0006
Apache Tomcat Security Information SECURITY
https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.2
Apache Tomcat Security Information SECURITY
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98
lists.debian.org/debian-lts-announce... WEB
https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
lists.apache.org/thread/tdtbbxpg5trd... WEB
https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n
Apache Tomcat Source Repository REPOSITORY
https://github.com/apache/tomcat
Apache Tomcat Security Information SECURITY
http://www.openwall.com/lists/oss-security/2024/12/17/5
Apache Tomcat Security Information SECURITY
http://www.openwall.com/lists/oss-security/2024/12/17/6
Apache Tomcat Security Information SECURITY
http://www.openwall.com/lists/oss-security/2024/12/18/1

Frequently Asked Questions

What is CVE-2024-54677?
CVE-2024-54677 is a security vulnerability in Apache Tomcat involving Apache Tomcat Uncontrolled Resource Consumption vulnerability under CWE-400: Uncontrolled Resource Consumption.
Which Apache Tomcat versions are affected?
Affected versions include releases prior to 11.0.2, 10.1.34, 9.0.98 across affected packages: org.apache.tomcat:tomcat.
What version fixes CVE-2024-54677?
Upgrading to 11.0.2, 10.1.34, 9.0.98 (or the latest patched release for your respective branch) resolves the vulnerability.
Is tomcat affected?
Yes, org.apache.tomcat:tomcat is affected in releases prior to 11.0.2, 10.1.34, 9.0.98. Upgrade your dependency to 11.0.2, 10.1.34, 9.0.98 or later.
What is the CVSS score of CVE-2024-54677?
CVE-2024-54677 has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
What CWE is associated with CVE-2024-54677?
CVE-2024-54677 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).
How can I check Maven dependencies for CVE-2024-54677?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.tomcat'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-653p-vg55-5652",
  "modified" : "2026-07-06T14:12:53Z",
  "published" : "2024-12-17T15:31:43Z",
  "aliases" : [ "CVE-2024-54677" ],
  "summary" : "Apache Tomcat Uncontrolled Resource Consumption vulnerability",
  "details" : "Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.\n\nThis vulnerability does not affect core Apache Tomcat server components (tomcat-catalina, tomcat-coyote, tomcat-embed-core, etc.). Removing the `webapps/examples/` directory in production environments — as recommended by the [Apache Tomcat Security Considerations documentation](https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Examples) — eliminates the attack surface entirely.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0-M1"
      }, {
        "fixed" : "11.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.1.0-M1"
      }, {
        "fixed" : "10.1.34"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.0.0.M1"
      }, {
        "fixed" : "9.0.98"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-54677"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/f57a9d9847c1038be61f5818d73b8be907c460d4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/e8c16cdba833884e1bd49fff1f1cb699da177585"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/dbec927859d9484cb8bd680a7c67b1a560f48444"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/d63a10afc142b12f462a15f7d10f79fd80ff94eb"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/cb1707685472994e9d924746f8c91cb116fa5213"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/c2f7ce21c3fb12caefee87c517a8bb4f80700044"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/c0a23927ea5e061ca3fdff695138464179fe674a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/bbd82e9593314ade4cfd57248f9285fbad686f66"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/aa5b4d0043289cf054f531ec55126c980d3572e1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/a95bf2b0303442a2c9a1ac364b0e63b56049e33a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/9ffd23fc27f5d1fc95bf97e5cea175c8968f4533"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/84c4af76e7a10fc7f8630ce62e6a46632ea4a90e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/84065e26ca4555e63a922bb29b13b0a1c86b7654"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/75ff7e8622edcc024b268677aa789ee8f0880ecc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/722814668708c42a61b0c1e340b15bc2b785c0d1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/721544ea28e92549824b106be954a9f411867a1c"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/54e56495e9a106218efe9fc9c79d976c0032bbfd"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/4f0236606961176257b883213e1621b1859ed746"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/4d5cc6538d91386f950373ac8120e98c2c78ed3a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/4a335c6dcba8d6f8a54629eda392a50da267bdf4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/3315a9027a7eaab18f42625b97b569940ff1365d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/1d88dd3ffaed76188dd4ee32ce77709ce6e153cd"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.34"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20250131-0006"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.2"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apache/tomcat"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2024/12/17/5"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2024/12/17/6"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2024/12/18/1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-12-17T16:41:30Z",
    "nvd_published_at" : "2024-12-17T13:15:18Z"
  }
}