CVE-2024-56337 Critical · 9.8 EPSS 9.0%

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

Apache Software Foundation · Apache Tomcat

Official description · CVE.org

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

Breakdown

72.3 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

Disclosed on 20 Dec 2024. No public exploit code or confirmed exploitation is recorded.

A fix was bypassed or incomplete once over 3 days. The latest fix listed for tomcat-catalina is 11.0.7.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2024-50379Tomcat: RCE due to TOCTOU issue in JSP compilation17 Dec 2024
incomplete fixHigh
Why these are linked:
- Stated in the CVE textThe mitigation for CVE-2024-50379 was incomplete.
- Linked in OSV/GitHub advisoryGHSA-27hp-xhwr-wr2m
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
This CVECVE-2024-56337Tomcat: RCE due to TOCTOU issue in JSP compilation…20 Dec 2024

Fixes in tomcat-catalinaMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

11.0.0-M5CVE-2023-2499820 Feb 2023
11.0.1CVE-2024-5231618 Nov 2024
11.0.2CVE-2024-5037917 Dec 2024
11.0.2CVE-2024-5633720 Dec 2024
11.0.3CVE-2025-2481310 Mar 2025KEV
11.0.6CVE-2025-3165128 Apr 2025
11.0.7CVE-2025-4670129 May 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

3 packages in 1 ecosystem. No single main package: each of these ships the affected code.

Mavenorg.apache.tomcat:tomcat-catalina
Affected: 11.0.0-M1 up to 11.0.2; 10.1.0-M1 up to 10.1.34Upgrade to 11.0.11 or later (older lines: 10.1.45)
GHSA-27hp-xhwr-wr2m
Mavenorg.apache.tomcat:tomcat-embed-core
Affected: 9.0.0.M1 up to 9.0.98Upgrade to 9.0.98 or later
GHSA-27hp-xhwr-wr2m
Mavenorg.apache.tomcat.embed:tomcat-embed-core
Affected: 11.0.0-M1 up to 11.0.2; 10.1.0-M1 up to 10.1.34; 9.0.0.M1 up to 9.0.98Upgrade to 11.0.11 or later (older lines: 10.1.45, 9.0.109)
GHSA-27hp-xhwr-wr2m

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 3 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2024-3542

No public exploit code found.

, 30 Oct 2026

9.0%Top 4.7%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 95.3%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 17 days ago 10.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9525 19.1/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses3 pulses 1.4/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total72.3

Record

Published: 20 Dec 2024
Modified: 4 Nov 2025
: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in tomcat-catalinaMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

What security researchers reported

Also mentioned in 3 community threat pulses (AlienVault OTX)

References

vdb-entry 1

vendor-advisory 1

Other 2

techniques