CVE-2024-56337: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-20 · updated 2026-06-17
Weakness: CWE-367

Description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

Summary

Apache Tomcat contains a TOCTOU race condition in JSP compilation that can lead to remote code execution, and the earlier fix for CVE-2024-50379 was incomplete. It affects Tomcat 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97, plus EOL versions 8.5.0 through 8.5.100. Exploitation has not been observed (not in CISA KEV, SSVC exploitation: none), though EPSS estimates a 9.0% chance of exploitation within 30 days. Upgrade to 11.0.2, 10.1.34, or 9.0.98 or later; if you run on a case-insensitive file system with the default servlet write enabled, also set sun.io.useCanonCaches to false on Java 8/11 (and on Java 17 if set).

تحتوي Apache Tomcat على ثغرة TOCTOU في تجميع JSP قد تؤدي إلى تنفيذ تعليمات برمجية عن بُعد، وكان الإصلاح السابق لـ CVE-2024-50379 غير مكتمل. تؤثر الثغرة في Tomcat 11.0.0-M1 حتى 11.0.1، و10.1.0-M1 حتى 10.1.33، و9.0.0.M1 حتى 9.0.97، إضافة إلى الإصدارات المنتهية الدعم 8.5.0 حتى 8.5.100. لم يُرصد استغلال فعلي (ليست في CISA KEV، وSSVC: none)، لكن EPSS تقدّر احتمال الاستغلال خلال 30 يوماً بنسبة 9.0%. يُنصح بالترقية إلى 11.0.2 أو 10.1.34 أو 9.0.98 أو أحدث؛ وإذا كان Tomcat يعمل على نظام ملفات غير حساس لحالة الأحرف مع تفعيل الكتابة في default servlet، فيجب ضبط sun.io.useCanonCaches على false في Java 8/11 (وفي Java 17 إن كان مضبوطاً).

Affected products

Apache Tomcat: from 9.0.0 before 9.0.98; from 10.1.0 before 10.1.34; from 11.0.0 before 11.0.2 — fixed in 10.1.34, 11.0.2, 9.0.98
NetApp Bootstrap Os: all versions

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.34, 11.0.2, 9.0.98. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-56337 or the next vulnerability affects your stack