Apache Tomcat: Request/response mix-up with HTTP/2 (CVE-2024-52317)
Description
Apache Tomcat contains a vulnerability in HTTP/2 request and response handling due to incorrect object recycling and reuse. This flaw can cause request and/or response mix-up between users, potentially leading to data leakage or confusion in multi-user scenarios. The issue affects specific versions of Apache Tomcat 9.0, 10.1, and 11.0. Upgrading to fixed versions resolves the problem.
Affected software
pkg:bitnami/tomcatRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-52317 is a vulnerability in Apache Tomcat involving incorrect recycling and reuse of request and response objects in HTTP/2 processing. This defect can lead to mixing requests and responses between different users, compromising the integrity of HTTP communications. The affected versions are Apache Tomcat 9.0.92 through 9.0.95, 10.1.27 through 10.1.30, and 11.0.0 through 11.0.8. The issue is fixed in versions 9.0.96, 10.1.31, and 11.0.9.
Potential Impact
The vulnerability may cause HTTP/2 requests and responses to be mixed up between users, which could lead to unintended data exposure or incorrect responses being served. This impacts the confidentiality and integrity of HTTP communications handled by affected Apache Tomcat servers.
Mitigation Recommendations
A patch is available. Users should upgrade affected Apache Tomcat versions to 9.0.96, 10.1.31, or 11.0.9 or later to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-tomcat-2024-52317
- Osv Schema Version
- 1.5.0
- Aliases
- CVE-2024-52317
- Ecosystems
- Bitnami
- Database Specific Severity
- Medium
Threat ID: 6aa005b8acd9273b49ab59ea
Added to database: 09/08/2026, 12:55:20 UTC
Last enriched: 09/08/2026, 13:13:27 UTC
Last updated: 10/24/2026, 08:45:07 UTC
Views: 34
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.