CVE-2024-50379: Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
Summary
CVE-2024-50379: Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. Affects org.apache.tomcat:tomcat-catalina across 4 version ranges.
>= 8.5.0, <= 8.5.100
>= 9.0.0.M1, < 9.0.98
>= 10.1.0-M1, < 10.1.34
>= 11.0.0-M1, < 11.0.2
Fixed in 9.0.98, 10.1.34 or 11.0.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2024-50379 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The package is known for its flexibility, scalability, and support for various Java technologies. However, it is susceptible to vulnerabilities that can compromise the security of applications deployed on it.
Vulnerability Detail
The vulnerability identified as CVE-2024-50379 is a Time-of-check Time-of-use (TOCTOU) race condition that occurs during JSP compilation in Apache Tomcat. This flaw allows an attacker to exploit the race condition on case-insensitive file systems, particularly when the default servlet is configured to allow write operations. If successfully exploited, this vulnerability can lead to Remote Code Execution (RCE), allowing unauthorized access and control over the affected system. This issue affects multiple versions of Apache Tomcat, making it critical for users to address it promptly.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0.0.M1, < 9.0.989.0.98 -
>= 10.1.0-M1, < 10.1.3410.1.34 -
>= 11.0.0-M1, < 11.0.211.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the default servlet's write permissions if they are not required for their application. This can help mitigate the risk until an upgrade can be performed.
Conclusion
CVE-2024-50379 represents a significant security risk for users of Apache Tomcat, particularly those running vulnerable versions with write permissions enabled. It is crucial to upgrade to the latest patched versions to mitigate this vulnerability and protect your applications from potential exploitation.
See every vulnerability recorded for org.apache.tomcat:tomcat-catalina →
FAQ
CVE-2024-50379 is a vulnerability in Apache Tomcat that allows for a Time-of-check Time-of-use (TOCTOU) race condition, potentially leading to Remote Code Execution.
The affected versions include Apache Tomcat from 11.0.0-M1 to 11.0.1, 10.1.0-M1 to 10.1.33, and 9.0.0.M1 to 9.0.97.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply checking your pom.xml, you can determine if your application is affected.
The CVSS score for CVE-2024-50379 is 9.8, indicating a high severity level.
If an immediate upgrade is not possible, consider disabling write permissions for the default servlet as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-catalina.
