Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.0-M1 – ≤ 11.0.24, 10.1.0-M1 – ≤ 10.1.57, 9.0.39 – ≤ 9.0.120, 8.5.59 – ≤ 8.5.100 | |
| apache | tomcat | 8.5.59 – < 9.0.121 |
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.5.59 < 9.0.121cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 10.1.0 < 10.1.58cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.0.25Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.