CVE-2024-56337
published 2024-12-20CVE-2024-56337: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
9.03%
94.7th percentile
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:
- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false)
- running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)
Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.34 | 10.1.34 |
| apache | tomcat | >= 11.0.0 < 11.0.2 | 11.0.2 |
| apache | tomcat | >= 9.0.0 < 9.0.98 | 9.0.98 |
| debian | tomcat10 | < tomcat10 10.1.34-0+deb12u1 (bookworm) | tomcat10 10.1.34-0+deb12u1 (bookworm) |
| debian | tomcat9 | < tomcat10 10.1.34-0+deb12u1 (bookworm) | tomcat10 10.1.34-0+deb12u1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploitation requires the default servlet write enabled: 'readonly' initialization parameter set to the non-default value of false on a case-insensitive file system (e.g., Windows or macOS) ↗
- →The attack vector is a TOCTOU race condition during JSP compilation — an uploaded file is treated as a JSP and executed, resulting in RCE. Detect unexpected JSP file creation/execution in writable servlet directories. ↗
- →Check for the system property sun.io.useCanonCaches being set to true (or not explicitly set to false) on Java 8 or Java 11 Tomcat deployments — this is the enabling condition for exploitation. ↗
- →Tomcat versions 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, 9.0.0.M1 through 9.0.97, and 8.5.0 through 8.5.100 are vulnerable. Flag these versions in asset inventory. ↗
- →CVE-2024-56337 is an incomplete fix for CVE-2024-50379 — detections or patches targeting only CVE-2024-50379 (Tomcat 11.0.2, 10.1.34, 9.0.98) are insufficient for Java 8/11 environments without the sun.io.useCanonCaches=false property. ↗
- ·Exploitation is only possible on case-insensitive file systems (e.g., Windows, macOS) — Linux/RHEL case-sensitive deployments are not vulnerable under normal conditions. ↗
- ·The default servlet write must be explicitly enabled (readonly=false) — this is non-default and not common in production environments, significantly limiting the attack surface. ↗
- ·Java 21+ deployments require no additional configuration changes — the problematic sun.io.useCanonCaches property and cache have been removed entirely. ↗
- ·Future Tomcat versions 11.0.3, 10.1.35, and 9.0.99 will enforce the safe sun.io.useCanonCaches configuration automatically before allowing default servlet write on case-insensitive file systems. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_apache9.8HIGH
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
ghsa·2024-12-20·CVSS 9.8
CVE-2024-56337 [CRITICAL] CWE-367 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:
- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
- running on Java 17: the system
OSV
CVE-2024-56337: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat
osv·2024-12-20·CVSS 9.8
CVE-2024-56337 [CRITICAL] CVE-2024-56337: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must
OSV
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
osv·2024-12-20·CVSS 9.8
CVE-2024-56337 [CRITICAL] Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:
- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
- running on Java 17: the system
Oracle
Oracle Oracle Communications Risk Matrix: BEServer (Apache Tomcat) — CVE-2024-56337
vendor_oracle·2025-04-15·CVSS 9.8
CVE-2024-56337 [CRITICAL] Oracle Oracle Communications Risk Matrix: BEServer (Apache Tomcat) — CVE-2024-56337
Oracle Oracle Communications Risk Matrix: BEServer (Apache Tomcat) vulnerability
CVE: CVE-2024-56337
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Tomcat) — CVE-2024-56337
vendor_oracle·2025-01-15·CVSS 9.8
CVE-2024-56337 [CRITICAL] Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Tomcat) — CVE-2024-56337
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Tomcat) vulnerability
CVE: CVE-2024-56337
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Red Hat
tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation
vendor_redhat·2024-12-20·CVSS 9.8
CVE-2024-56337 [CRITICAL] CWE-367 tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation
tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using wit
Debian
CVE-2024-56337: tomcat10 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat...
vendor_debian·2024·CVSS 9.8
CVE-2024-56337 [CRITICAL] CVE-2024-56337: tomcat10 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat...
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must
Apache
Apache tomcat: CVE-2024-50379
vendor_apache·CVSS 9.8
CVE-2024-50379 [HIGH] Apache tomcat: CVE-2024-50379
Apache tomcat: CVE-2024-50379
CVE-2024-56337 The previous mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 11.0.2 or later, users running Tomcat on a case insensitive file system with the default servlet write enabled may need additional configuration depending on the version of Java being used: running on Java 17: the system property sun.io.useCanonCaches , if set, must be set to false (it defaults to false ) running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) This issue was reported to the Tomcat security team on 17 December 2024. The issue was made public on 20 December 2024. Affects: 11.0.0-M1 to 11.0.1
Severity: high
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Brute-force attacks target Apache Tomcat management panels
blogs_bleepingcomputer·2025-06-11
Brute-force attacks target Apache Tomcat management panels
## Brute-force attacks target Apache Tomcat management panels
## Sergiu Gatlan
A coordinated campaign of brute-force attacks using hundreds of unique IP addresses targets Apache Tomcat Manager interfaces exposed online.
Tomcat is a popular open-source web server widely used by large enterprises and SaaS providers, while Tomcat Manager is a web-based administration tool that comes bundled with the Tomcat server and helps admins manage deployed web apps via a graphical interface.
Tomcat Manager is configured by default to only allow access from localhost (127.0.0.1), with no pre-configured credentials and remote access blocked. However, when exposed online, the web app can be targeted by attackers, as cybersecurity company GreyNoise observed recently.
Starting June 5th, GreyNoise analys
Qualys
Oracle Critical Patch Update, April 2025 Security Update Review
blogs_qualys·2025-04-16
Oracle Critical Patch Update, April 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its first quarterly edition of this year’s Critical Patch Update. The update received patches for 378 s ecurity vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 103, constituting about 27% of the total patches released. Oracle MySQL and Oracle Communications Applications followed, with 43 and 42 security patches.
300 of the 378 security patches provided by the April Critical Patch Update (about 79%) are for non-Ora
Qualys
Oracle Critical Patch Update, April 2025 Security Update Review | Qualys
blogs_qualys·2025-04-16
Oracle Critical Patch Update, April 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
Oracle released its first quarterly edition of this year’s Critical Patch Update. The update received patches for 378 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 103, constituting about 27% of the total patches released. Oracle MySQL and Oracle Communications Applications followed, with 43 and 42 security patches.
300 of the 378 security patches provided by the April Critical Patch Update (about 79%) are for non
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications followed,
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications fol
Bleepingcomputer
Apache fixes remote code execution bypass in Tomcat web server
blogs_bleepingcomputer·2024-12-23·CVSS 9.8
[CRITICAL] Apache fixes remote code execution bypass in Tomcat web server
## Apache fixes remote code execution bypass in Tomcat web server
## Bill Toulas
Apache has released a security update to address an important vulnerability in Tomcat web server that could lead to an attacker achieving remote code execution.
Apache Tomcat is an open-source web server and servlet container widely used to deploy and run Java-based web applications. It provides a runtime environment for Java Servlets, JavaServer Pages (JSP), and Java WebSocket technologies.
The product is popular with large enterprises that run custom web apps, SaaS providers that rely on Java for backend services. Cloud and hosting services integrateTomcat for app hosting, and software developers use it to build, test, and deploy web apps.
The vulnerability fixed is tracked as CVE-2024-56337 and it repr
2024-12-20
Published