CVE-2024-52316: Apache Tomcat Authentication Bypass Vulnerability
Summary
CVE-2024-52316: Apache Tomcat - Authentication Bypass. Affects org.apache.tomcat:tomcat-catalina across 3 version ranges.
< 9.0.96
>= 10.1.0-M1, < 10.1.30
>= 11.0.0-M1, < 11.0.1
Fixed in 9.0.96, 10.1.30 or 11.0.1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2024-52316 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The software is known for its scalability, reliability, and support for various protocols. However, it is susceptible to vulnerabilities that can compromise the security of applications deployed on it.
Vulnerability Detail
The vulnerability identified as CVE-2024-52316 is an unchecked error condition in Apache Tomcat's authentication process. When configured with a custom Jakarta Authentication ServerAuthContext component, if an exception occurs during authentication without setting an appropriate HTTP status to indicate failure, the authentication may not fail as expected. This flaw allows unauthorized users to bypass the authentication process, potentially leading to unauthorized access to sensitive resources. The vulnerability affects multiple versions of Tomcat, specifically from 11.0.0-M1 to 11.0.0-M26, 10.1.0-M1 to 10.1.30, and 9.0.0-M1 to 9.0.95.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 9.0.969.0.96 -
>= 10.1.0-M1, < 10.1.3010.1.30 -
>= 11.0.0-M1, < 11.0.111.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any custom Jakarta Authentication components explicitly set an HTTP status code to indicate authentication failure when exceptions occur. This can help mitigate the risk of unauthorized access until an upgrade can be performed.
Conclusion
CVE-2024-52316 represents a significant security risk for users of Apache Tomcat, allowing potential bypass of authentication mechanisms. It is crucial for users to upgrade to the latest patched versions to mitigate this vulnerability and protect their applications from unauthorized access.
See every vulnerability recorded for org.apache.tomcat:tomcat-catalina →
FAQ
CVE-2024-52316 is a vulnerability in Apache Tomcat that allows for authentication bypass due to unchecked error conditions in custom authentication components.
The vulnerability affects Apache Tomcat versions from 11.0.0-M1 to 11.0.0-M26, 10.1.0-M1 to 10.1.30, and 9.0.0-M1 to 9.0.95.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by using the Vulert playground without any signup.
The CVSS score of CVE-2024-52316 is 9.8, indicating a critical level of severity.
If an immediate upgrade is not possible, implement a workaround by ensuring that your custom authentication components set an HTTP status code on failure.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-catalina.
