CVE-2024-50379
published 2024-12-17CVE-2024-50379: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when…
PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
44.31%
98.6th percentile
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.34 | 10.1.34 |
| apache | tomcat | >= 11.0.0 < 11.0.2 | 11.0.2 |
| apache | tomcat | >= 9.0.0 < 9.0.98 | 9.0.98 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.33 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.1 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.97 | — |
| debian | tomcat10 | < tomcat10 10.1.34-0+deb12u1 (bookworm) | tomcat10 10.1.34-0+deb12u1 (bookworm) |
| debian | tomcat9 | < tomcat10 10.1.34-0+deb12u1 (bookworm) | tomcat10 10.1.34-0+deb12u1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploitation requires the default servlet write enabled: 'readonly' initialization parameter set to false (non-default). Detect by auditing Tomcat web.xml for DefaultServlet with readonly=false. ↗
- →Attack vector: an uploaded file is treated as a JSP and executed via race condition. Monitor for unexpected JSP file creation in writable servlet directories followed by immediate HTTP GET/execution requests to those paths. ↗
- →Exploitation requires concurrent read and upload operations on the same file. Detect anomalous simultaneous PUT and GET requests to the same resource path on Tomcat, especially for .jsp extensions. ↗
- →CVE-2024-56337 is an incomplete fix for CVE-2024-50379 affecting Java 8/11 deployments where sun.io.useCanonCaches defaults to true. Flag Tomcat instances running Java 8 or 11 without sun.io.useCanonCaches=false as still vulnerable even after patching to 11.0.2/10.1.34/9.0.98. ↗
- →Affected version ranges for detection/asset inventory: Apache Tomcat 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, 9.0.0.M1 through 9.0.97, and 8.5.0 through 8.5.100. ↗
- ·Vulnerability is only exploitable when the DefaultServlet readonly parameter is explicitly set to false — this is NOT the default configuration. Default deployments are not vulnerable. ↗
- ·Exploitation additionally requires a case-insensitive file system (e.g., Windows or macOS). Linux/RHEL case-sensitive file systems are not vulnerable. ↗
- ·Patching to 11.0.2/10.1.34/9.0.98 alone is insufficient for Java 8 or 11 users — sun.io.useCanonCaches must also be explicitly set to false, otherwise CVE-2024-56337 (incomplete fix) still applies. ↗
- ·For Java 17, sun.io.useCanonCaches must not be set to true (default is false, so only misconfigured systems are at risk). For Java 21+, no additional configuration is needed. ↗
- ·Future Tomcat versions (11.0.3, 10.1.35, 9.0.99) will add automatic checks for sun.io.useCanonCaches correctness before allowing default servlet write on case-insensitive file systems, reducing misconfiguration risk. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_apache9.8HIGH
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2025-08-20·CVSS 9.8
CVE-2024-50379 [CRITICAL] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat did not correctly handle case sensitivity.
An attacker could possibly use this issue to bypass authentication
mechanisms. (CVE-2025-46701)
Elysee Franchuk discovered that Tomcat did not correctly limit the number
of attributes for a session. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS.
(CVE-2024-54677)
It was discovered that Tomcat did not correctly sanitize certain URLs. An
attacker could possibly use this issue to bypass authentication
mechanisms. (CVE-2025-31651)
It was discovered that Tomcat did not correctly handle certain malformed
HTTP headers,
which could lead to a memory leak. An attacker could
Red Hat
tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation
vendor_redhat·2024-12-20·CVSS 9.8
CVE-2024-56337 [CRITICAL] CWE-367 tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation
tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using wit
Red Hat
tomcat: RCE due to TOCTOU issue in JSP compilation
vendor_redhat·2024-12-17·CVSS 9.8
CVE-2024-50379 [CRITICAL] CWE-367 tomcat: RCE due to TOCTOU issue in JSP compilation
tomcat: RCE due to TOCTOU issue in JSP compilation
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
A flaw was found in Tomcat. A Time-of-check Time-of-use (TOCTOU) race condition occurs during JSP compilation on case-insensitive file
Debian
CVE-2024-50379: tomcat10 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compi...
vendor_debian·2024·CVSS 9.8
CVE-2024-50379 [CRITICAL] CVE-2024-50379: tomcat10 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compi...
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Scope: local
bookworm: resolved (fixed in 10.1.34-0+deb12u1)
forky: resolved (fixed in 10.1.34-1)
sid: resolved (fixed in 10.1.34-1)
trixie: resolved (fixed in 10.1.34-1)
Debian
CVE-2024-56337: tomcat10 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat...
vendor_debian·2024·CVSS 9.8
CVE-2024-56337 [CRITICAL] CVE-2024-56337: tomcat10 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat...
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must
Apache
Apache tomcat: CVE-2024-50379
vendor_apache·CVSS 9.8
CVE-2024-50379 [HIGH] Apache tomcat: CVE-2024-50379
Apache tomcat: CVE-2024-50379
CVE-2024-56337 The previous mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 11.0.2 or later, users running Tomcat on a case insensitive file system with the default servlet write enabled may need additional configuration depending on the version of Java being used: running on Java 17: the system property sun.io.useCanonCaches , if set, must be set to false (it defaults to false ) running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) This issue was reported to the Tomcat security team on 17 December 2024. The issue was made public on 20 December 2024. Affects: 11.0.0-M1 to 11.0.1
Severity: high
OSV
tomcat10 vulnerabilities
osv·2025-08-20·CVSS 9.8
CVE-2025-46701 [CRITICAL] tomcat10 vulnerabilities
tomcat10 vulnerabilities
It was discovered that Tomcat did not correctly handle case sensitivity.
An attacker could possibly use this issue to bypass authentication
mechanisms. (CVE-2025-46701)
Elysee Franchuk discovered that Tomcat did not correctly limit the number
of attributes for a session. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS.
(CVE-2024-54677)
It was discovered that Tomcat did not correctly sanitize certain URLs. An
attacker could possibly use this issue to bypass authentication
mechanisms. (CVE-2025-31651)
It was discovered that Tomcat did not correctly handle certain malformed
HTTP headers,
which could lead to a memory leak. An attacker could possibly use this
issue to cause a denial of service. This i
GHSA
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
ghsa·2024-12-20·CVSS 9.8
CVE-2024-56337 [CRITICAL] CWE-367 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:
- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
- running on Java 17: the system
OSV
CVE-2024-56337: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat
osv·2024-12-20·CVSS 9.8
CVE-2024-56337 [CRITICAL] CVE-2024-56337: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must
OSV
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
osv·2024-12-20·CVSS 9.8
CVE-2024-56337 [CRITICAL] Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:
- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
- running on Java 17: the system
OSV
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
osv·2024-12-17
CVE-2024-50379 [HIGH] Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
OSV
CVE-2024-50379: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file system
osv·2024-12-17·CVSS 9.8
CVE-2024-50379 [CRITICAL] CVE-2024-50379: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file system
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
GHSA
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
ghsa·2024-12-17
CVE-2024-50379 [HIGH] CWE-367 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Suricata
ET WEB_SPECIFIC_APPS Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition during JSP Compilation (CVE-2024-50379)
suricata·2025-01-27·CVSS 9.8
CVE-2024-50379 [CRITICAL] ET WEB_SPECIFIC_APPS Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition during JSP Compilation (CVE-2024-50379)
ET WEB_SPECIFIC_APPS Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition during JSP Compilation (CVE-2024-50379)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition during JSP Compilation (CVE-2024-50379)"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:".jsp"; endswith; nocase; http.content_type; content:"application/json"; http.request_body; content:"|3c 25|"; startswith; content:"|2e|exec|28|"; fast_pattern; threshold:type both,track by_src, count 300, seconds 60; reference:url,github.com/ph0ebus/Tomcat-CVE-2024-50379-Poc; reference:cve,2024-50379; classtype:web-application-attack; sid:2059684; rev:1; metadata:affected_product Apache_Tomcat, attack_target Se
No public exploits indexed.
Bleepingcomputer
Brute-force attacks target Apache Tomcat management panels
blogs_bleepingcomputer·2025-06-11
Brute-force attacks target Apache Tomcat management panels
## Brute-force attacks target Apache Tomcat management panels
## Sergiu Gatlan
A coordinated campaign of brute-force attacks using hundreds of unique IP addresses targets Apache Tomcat Manager interfaces exposed online.
Tomcat is a popular open-source web server widely used by large enterprises and SaaS providers, while Tomcat Manager is a web-based administration tool that comes bundled with the Tomcat server and helps admins manage deployed web apps via a graphical interface.
Tomcat Manager is configured by default to only allow access from localhost (127.0.0.1), with no pre-configured credentials and remote access blocked. However, when exposed online, the web app can be targeted by attackers, as cybersecurity company GreyNoise observed recently.
Starting June 5th, GreyNoise analys
Bleepingcomputer
Apache fixes remote code execution bypass in Tomcat web server
blogs_bleepingcomputer·2024-12-23·CVSS 9.8
[CRITICAL] Apache fixes remote code execution bypass in Tomcat web server
## Apache fixes remote code execution bypass in Tomcat web server
## Bill Toulas
Apache has released a security update to address an important vulnerability in Tomcat web server that could lead to an attacker achieving remote code execution.
Apache Tomcat is an open-source web server and servlet container widely used to deploy and run Java-based web applications. It provides a runtime environment for Java Servlets, JavaServer Pages (JSP), and Java WebSocket technologies.
The product is popular with large enterprises that run custom web apps, SaaS providers that rely on Java for backend services. Cloud and hosting services integrateTomcat for app hosting, and software developers use it to build, test, and deploy web apps.
The vulnerability fixed is tracked as CVE-2024-56337 and it repr
Greynoiseio
NoiseLetter January 2025
blogs_greynoiseio
NoiseLetter January 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
HackerOne
[SECURITY] CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet
hackerone·2025-05-27·CVSS 9.8
CVE-2024-50379 [CRITICAL] [SECURITY] CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet
[SECURITY] CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet
Code injection triggered by a race condition on a Windows machine.
## Impact
Code injection
If the default servlet is write enabled (readonly initialisation
parameter set to the non-default value of false) for a case insensitive
file system, concurrent read and upload under load of the same file can
bypass Tomcat's case sensitivity checks and cause an uploaded file to be
treated as a JSP leading to remote code execution.
https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
2024-12-17
Published