Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3vdn-j7sj-dfdn
Vulnerability ID VCID-3vdn-j7sj-dfdn
Aliases CVE-2024-38286
GHSA-7jqf-v358-p8g7
Summary Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38286.json
epss 0.00401 https://api.first.org/data/v1/epss?cve=CVE-2024-38286
epss 0.00401 https://api.first.org/data/v1/epss?cve=CVE-2024-38286
epss 0.00401 https://api.first.org/data/v1/epss?cve=CVE-2024-38286
epss 0.00401 https://api.first.org/data/v1/epss?cve=CVE-2024-38286
epss 0.00401 https://api.first.org/data/v1/epss?cve=CVE-2024-38286
epss 0.00401 https://api.first.org/data/v1/epss?cve=CVE-2024-38286
epss 0.00401 https://api.first.org/data/v1/epss?cve=CVE-2024-38286
epss 0.00401 https://api.first.org/data/v1/epss?cve=CVE-2024-38286
apache_tomcat Important https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38286
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-7jqf-v358-p8g7
cvssv3.1 8.6 https://github.com/apache/tomcat
cvssv4 7.7 https://github.com/apache/tomcat
generic_textual HIGH https://github.com/apache/tomcat
cvssv3.1 8.6 https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93
cvssv4 7.7 https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93
generic_textual HIGH https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93
cvssv3.1 8.6 https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543
cvssv4 7.7 https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543
generic_textual HIGH https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543
cvssv3.1 8.6 https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13
cvssv4 7.7 https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13
generic_textual HIGH https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13
cvssv3.1 8.6 https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
cvssv4 7.7 https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
generic_textual HIGH https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
ssvc Track https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
cvssv3.1 8.6 https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
cvssv4 7.7 https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
cvssv3.1 8.6 https://nvd.nist.gov/vuln/detail/CVE-2024-38286
cvssv4 7.7 https://nvd.nist.gov/vuln/detail/CVE-2024-38286
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-38286
cvssv3.1 8.6 https://security.netapp.com/advisory/ntap-20241101-0010
cvssv4 7.7 https://security.netapp.com/advisory/ntap-20241101-0010
generic_textual HIGH https://security.netapp.com/advisory/ntap-20241101-0010
cvssv3.1 8.6 http://www.openwall.com/lists/oss-security/2024/09/23/2
cvssv4 7.7 http://www.openwall.com/lists/oss-security/2024/09/23/2
generic_textual HIGH http://www.openwall.com/lists/oss-security/2024/09/23/2
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38286.json
https://api.first.org/data/v1/epss?cve=CVE-2024-38286
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat
https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93
https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543
https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13
https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
https://nvd.nist.gov/vuln/detail/CVE-2024-38286
https://security.netapp.com/advisory/ntap-20241101-0010
http://www.openwall.com/lists/oss-security/2024/09/23/2
2314686 https://bugzilla.redhat.com/show_bug.cgi?id=2314686
CVE-2024-38286 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38286
GHSA-7jqf-v358-p8g7 https://github.com/advisories/GHSA-7jqf-v358-p8g7
RHSA-2024:4976 https://access.redhat.com/errata/RHSA-2024:4976
RHSA-2024:4977 https://access.redhat.com/errata/RHSA-2024:4977
RHSA-2024:5024 https://access.redhat.com/errata/RHSA-2024:5024
RHSA-2024:5025 https://access.redhat.com/errata/RHSA-2024:5025
RHSA-2024:5693 https://access.redhat.com/errata/RHSA-2024:5693
RHSA-2024:5694 https://access.redhat.com/errata/RHSA-2024:5694
RHSA-2024:5695 https://access.redhat.com/errata/RHSA-2024:5695
RHSA-2024:5696 https://access.redhat.com/errata/RHSA-2024:5696
RHSA-2024:8494 https://access.redhat.com/errata/RHSA-2024:8494
RHSA-2024:8497 https://access.redhat.com/errata/RHSA-2024:8497
RHSA-2024:8528 https://access.redhat.com/errata/RHSA-2024:8528
RHSA-2024:8543 https://access.redhat.com/errata/RHSA-2024:8543
RHSA-2024:8567 https://access.redhat.com/errata/RHSA-2024:8567
RHSA-2024:8572 https://access.redhat.com/errata/RHSA-2024:8572
USN-7562-1 https://usn.ubuntu.com/7562-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38286.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T16:33:49Z/ Found at https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-38286
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-38286
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20241101-0010
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at https://security.netapp.com/advisory/ntap-20241101-0010
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2024/09/23/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H Found at http://www.openwall.com/lists/oss-security/2024/09/23/2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.60731
EPSS Score 0.00401
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:38:04.295147+00:00 Apache Tomcat Importer Import https://tomcat.apache.org/security-11.html 38.0.0