This vulnerability is a TOCTOU race condition in Apache Tomcat affecting versions from 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, 9.0.0.M1 through 9.0.97, and 8.5.0 through 8.5.100 (EOL). It arises when Tomcat is run on case insensitive file systems with the default servlet write enabled (readonly initialization parameter set to false). The mitigation for CVE-2024-50379 was incomplete, requiring additional configuration of the Java system property sun.io.useCanonCaches depending on the Java version: set to false explicitly on Java 8 and 11, set to false if set on Java 17, and no action needed on Java 21 and later. Tomcat 11.0.3, 10.1.35, and 9.0.99 and later versions include built-in checks and default the system property to false where applicable to prevent exploitation.

The vulnerability allows an attacker to exploit a race condition in file handling on case insensitive file systems, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Tomcat server. The CVSS 3.1 vector indicates network exploitable with low complexity, no privileges or user interaction required, and critical impact on all security properties. This could enable remote attackers to execute unauthorized actions or disrupt service.

Fixes are available starting with Tomcat versions 11.0.3, 10.1.35, and 9.0.99 which include checks to ensure the system property sun.io.useCanonCaches is set appropriately and default it to false when possible. Users running affected versions should upgrade to these or later versions. For those unable to upgrade immediately, configure the Java system property sun.io.useCanonCaches to false explicitly if running on Java 8 or 11, and ensure it is false if set on Java 17. No additional configuration is required for Java 21 or later. This mitigates the incomplete fix from CVE-2024-50379. Users should verify their default servlet write setting and file system case sensitivity to assess exposure.