CVE-2024-23672: Denial of Service via incomplete cleanup vulnerability in Apache Tomcat
6.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.61408%
CWE
Published
3/13/2024
Updated
2/13/2025
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat-websocket | maven | >= 11.0.0-M1, <= 11.0.0-M16 | 11.0.0-M17 |
| org.apache.tomcat:tomcat-websocket | maven | >= 10.1.0-M1, <= 10.1.18 | 10.1.19 |
| org.apache.tomcat:tomcat-websocket | maven | >= 9.0.0-M1, <= 9.0.85 | 9.0.86 |
| org.apache.tomcat:tomcat-websocket | maven | >= 8.5.0, <= 8.5.98 | 8.5.99 |
| org.apache.tomcat.embed:tomcat-embed-websocket | maven | >= 11.0.0-M1, <= 11.0.0-M16 | 11.0.0-M17 |
| org.apache.tomcat.embed:tomcat-embed-websocket | maven | >= 10.1.0-M1, <= 10.1.18 | 10.1.19 |
| org.apache.tomcat.embed:tomcat-embed-websocket | maven | >= 9.0.0-M1, <= 9.0.85 | 9.0.86 |
| org.apache.tomcat.embed:tomcat-embed-websocket | maven | >= 8.5.0, <= 8.5.98 | 8.5.99 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from incomplete cleanup during WebSocket closure. The commit introduces:
- A new closeConnection() method in WsSession.java to handle unregistration.
- Session close timeout tracking (sessionCloseTimeoutExpiry).
- checkCloseTimeout() in the background process. The original doClose/onClose methods directly called wsRemoteEndpoint.close() without session cleanup, and the background process lacked timeout enforcement. These gaps allowed clients to keep connections open via suspended/resumed sessions without proper termination.