CVE-2024-34750: Apache Tomcat: HTTP/2 excess header handling DoS

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-03 · updated 2026-06-17
Weakness: CWE-400

Description

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

Affected products

Apache Tomcat: from 9.0.0 before 9.0.90; from 10.1.0 before 10.1.25; 11.0.0-milestone1, 11.0.0-milestone10, 11.0.0-milestone11, 11.0.0-milestone12, 11.0.0-milestone13, 11.0.0-milestone14 (+14) — fixed in 10.1.25, 9.0.90
NetApp Ontap Tools: 9

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.25, 9.0.90. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-34750 or the next vulnerability affects your stack