Описание
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
A flaw was found in Apache Tomcat. An unauthenticated remote attacker can send a specially crafted AJP (Apache JServ Protocol) request, causing an AJP processing thread to become unresponsive. This resource exhaustion can lead to a denial of service (DoS), making the server unavailable to legitimate users.
Отчет
This vulnerability is rated as having Important impact because an unauthenticated remote attacker can exhaust connector thread pools without authentication, resulting in complete denial of service for the application server. In Red Hat Enterprise Linux and JBoss Web Server environments, the AJP connector is typically disabled by default or bound to loopback interfaces, limiting exposure unless explicitly configured to accept external connections. Consequently, deployments are primarily susceptible when Tomcat services expose AJP listener ports to untrusted networks.
Меры по смягчению последствий
This issue can be mitigated by disabling AJP connector or restricting access to it to only trusted AJP clients.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | tomcat | Affected | ||
| Red Hat Enterprise Linux 10 | tomcat9 | Affected | ||
| Red Hat Enterprise Linux 6 | tomcat6 | Out of support scope | ||
| Red Hat Enterprise Linux 7 | tomcat | Out of support scope | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/pki-servlet-engine | Affected | ||
| Red Hat Enterprise Linux 8 | tomcat | Affected | ||
| Red Hat Enterprise Linux 9 | pki-servlet-engine | Affected | ||
| Red Hat Enterprise Linux 9 | tomcat | Affected | ||
| Red Hat Hardened Images | hi/tomcat | Not affected | ||
| Red Hat JBoss Web Server 5 | jws5-tomcat | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Allocation of resources without limits or throttling vulnerability in ...
EPSS
7.5 High
CVSS3