CVE-2024-34750 Apache Tomcat DoS vulnerability in HTTP/2 connector

High

Internet Bug Bounty

Submitted None

Team Summary

Official summary from Internet Bug Bounty

###CVE-2024-34750 Apache Tomcat - Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.0-M20 Apache Tomcat 10.1.0-M1 to 10.1.24 Apache Tomcat 9.0.0-M1 to 9.0.89 Description: When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.0-M21 or later - Upgrade to Apache Tomcat 10.1.25 or later - Upgrade to Apache Tomcat 9.0.90 or later Credit: This vulnerability was reported responsibly to the Tomcat security team by devme4f from VNPT-VCI.

Actions:

View on HackerOne

Reported by devme4f

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption

Hello IBB team, i would like to submit a report about Apache Tomcat DoS vulnerability that i have reported to the Tomcat team, which was assigned to CVE-2024-34750 and disclosed yesterday. **Details:** When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. **Here is the email thread that i contacted the security team:** ██████████ ## Impact Since HTTP/2 connections are left open indefinitely, depending on configuration the DoS is caused either by the server running out of memory or by the open connections reaching maxConnections.

Related CVEs

Associated Common Vulnerabilities and Exposures

CVE-2024-34750 HIGH

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which …

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$4920.00

Submitted

Weakness

Uncontrolled Resource Consumption