Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/47249?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47249?format=api", "vulnerability_id": "VCID-j66a-6et3-mfha", "summary": "Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.", "aliases": [ { "alias": "CVE-2024-24549" }, { "alias": "GHSA-7w75-32cg-r6g2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/69388?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.99", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.99" }, { "url": "http://public2.vulnerablecode.io/api/packages/69387?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.86", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.86" }, { "url": "http://public2.vulnerablecode.io/api/packages/69386?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/69385?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@11.0.0-M17", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.0-M17" }, { "url": "http://public2.vulnerablecode.io/api/packages/69394?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.99", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.99" }, { "url": "http://public2.vulnerablecode.io/api/packages/69393?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.86", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.86" }, { "url": "http://public2.vulnerablecode.io/api/packages/69392?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/69391?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@11.0.0-M17", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-coyote@11.0.0-M17" }, { "url": "http://public2.vulnerablecode.io/api/packages/69398?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.99", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.99" }, { "url": "http://public2.vulnerablecode.io/api/packages/69399?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.86", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.86" }, { "url": "http://public2.vulnerablecode.io/api/packages/69400?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/69401?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.0-M17", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.0-M17" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/53455?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3nsr-9s9y-ckft" }, { "vulnerability": "VCID-4nx6-t8vd-bqcu" }, { "vulnerability": "VCID-axzz-cadr-b7fv" }, { "vulnerability": "VCID-dast-z2hv-2yfe" }, { "vulnerability": "VCID-dbu6-fhrs-aubn" }, { "vulnerability": "VCID-dk58-p9py-rka9" }, { "vulnerability": "VCID-gmjm-6ck2-skgu" }, { "vulnerability": "VCID-j66a-6et3-mfha" }, { "vulnerability": "VCID-kqng-d1f2-myg5" }, { "vulnerability": "VCID-paqj-ye46-8bdb" }, { "vulnerability": "VCID-qth9-7326-hffp" }, { "vulnerability": "VCID-rk89-9dw5-w3gg" }, { "vulnerability": "VCID-se44-f85s-xyex" }, { "vulnerability": "VCID-urhs-6aus-syb1" }, { "vulnerability": "VCID-xa95-zsnk-3kg9" }, { "vulnerability": "VCID-xns8-63b5-guf2" }, { "vulnerability": "VCID-y4a2-mamb-yqg6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/64360?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.0-M1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-j66a-6et3-mfha" }, { "vulnerability": "VCID-paqj-ye46-8bdb" }, { "vulnerability": "VCID-urhs-6aus-syb1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.0-M1" }, { "url": "http://public2.vulnerablecode.io/api/packages/64361?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.0-M1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-d8re-94xd-nycp" }, { "vulnerability": "VCID-j66a-6et3-mfha" }, { "vulnerability": "VCID-kqng-d1f2-myg5" }, { "vulnerability": "VCID-paqj-ye46-8bdb" }, { "vulnerability": "VCID-urhs-6aus-syb1" }, { "vulnerability": "VCID-wcnj-bna8-7fh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.0-M1" }, { "url": "http://public2.vulnerablecode.io/api/packages/64362?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.0-M1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-d8re-94xd-nycp" }, { "vulnerability": "VCID-j66a-6et3-mfha" }, { "vulnerability": "VCID-kqng-d1f2-myg5" }, { "vulnerability": "VCID-paqj-ye46-8bdb" }, { "vulnerability": "VCID-urhs-6aus-syb1" }, { "vulnerability": "VCID-wcnj-bna8-7fh7" }, { "vulnerability": "VCID-y4a2-mamb-yqg6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.0-M1" } ], "references": [ { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/0cac540a882220231ba7a82330483cbd5f6b1f96", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/0cac540a882220231ba7a82330483cbd5f6b1f96" }, { "reference_url": "https://github.com/apache/tomcat/commit/810f49d5ff6d64b704af85d5b8d0aab9ec3c83f5", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/810f49d5ff6d64b704af85d5b8d0aab9ec3c83f5" }, { "reference_url": "https://github.com/apache/tomcat/commit/8e03be9f2698f2da9027d40b9e9c0c9429b74dc0", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/8e03be9f2698f2da9027d40b9e9c0c9429b74dc0" }, { "reference_url": "https://github.com/apache/tomcat/commit/d07c82194edb69d99b438828fe2cbfadbb207843", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/d07c82194edb69d99b438828fe2cbfadbb207843" }, { "reference_url": "https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20240402-0002", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20240402-0002" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549", "reference_id": "CVE-2024-24549", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" }, { "reference_url": "https://github.com/advisories/GHSA-7w75-32cg-r6g2", "reference_id": "GHSA-7w75-32cg-r6g2", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-7w75-32cg-r6g2" } ], "weaknesses": [ { "cwe_id": 20, "name": "Improper Input Validation", "description": "The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-j66a-6et3-mfha" }