Apache Tomcat: Denial of Service (CVE-2024-38286)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
AI Analysis
Technical Summary
CVE-2024-38286 is a denial of service vulnerability in the Tomcat component included in Red Hat's PKI Core packages. The vulnerability arises from incorrect handling of TLS handshake processes under certain configurations, which could be exploited by an attacker to cause a denial of service. Red Hat has issued security advisories and patches for affected versions of Red Hat Enterprise Linux 8.8 and related packages. The vulnerability is tracked under CWE-400 (Uncontrolled Resource Consumption).
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by exploiting improper handling of TLS handshake processes in Tomcat. This could disrupt availability of services relying on the affected Tomcat versions within the PKI Core infrastructure. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
A patch is available from Red Hat for the affected packages. Users should apply the security update for pki-core:10.6 and pki-deps:10.6 modules as provided in Red Hat Enterprise Linux 8.8 Extended Update Support. The update addresses the denial of service vulnerability CVE-2024-38286. Follow Red Hat's official guidance at https://access.redhat.com/articles/11258 to apply the update. No additional mitigation steps are required beyond applying the official patch.
Apache Tomcat: Denial of Service (CVE-2024-38286)
Description
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
Affected software
pkg:deb/ubuntu/[email protected]~18.04.3+esm6?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/[email protected]+esm7?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/[email protected]+esm2?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/[email protected]+esm3?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/[email protected]~esm2?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/[email protected]+esm2?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/[email protected]?arch=source&distro=questingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-38286 is a denial of service vulnerability in the Tomcat component included in Red Hat's PKI Core packages. The vulnerability arises from incorrect handling of TLS handshake processes under certain configurations, which could be exploited by an attacker to cause a denial of service. Red Hat has issued security advisories and patches for affected versions of Red Hat Enterprise Linux 8.8 and related packages. The vulnerability is tracked under CWE-400 (Uncontrolled Resource Consumption).
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by exploiting improper handling of TLS handshake processes in Tomcat. This could disrupt availability of services relying on the affected Tomcat versions within the PKI Core infrastructure. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
A patch is available from Red Hat for the affected packages. Users should apply the security update for pki-core:10.6 and pki-deps:10.6 modules as provided in Red Hat Enterprise Linux 8.8 Extended Update Support. The update addresses the denial of service vulnerability CVE-2024-38286. Follow Red Hat's official guidance at https://access.redhat.com/articles/11258 to apply the update. No additional mitigation steps are required beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2024-38286
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10"]
- Cvss Version
- 3.1
Threat ID: 6a58b50e68715ace43db3276
Added to database: 07/16/2026, 10:40:14 UTC
Last enriched: 08/04/2026, 16:24:12 UTC
Last updated: 09/10/2026, 20:08:48 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.