Skip to content
Fencer Vulns
medium 5.3

CVE-2024-21733 json

Apache Tomcat: Leaking of unrelated request bodies in default error page

published 2024-01-19 2 y ago modified 2026-09-08 2 mo ago also BIT-tomcat-2024-21733 , EUVD-2024-0340 , GHSA-f4qf-m5gf-8jm8

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
14.3%
EPSS 14.3% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected.

Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

Patch / fix

  • maven org.apache.tomcat:tomcat-coyote 8.5.64, 9.0.44
  • maven org.apache.tomcat.embed:tomcat-embed-core 8.5.64, 9.0.44
  • maven org.apache.tomcat.experimental:tomcat-embed-programmatic 9.0.44
  • bitnami tomcat 8.5.98, 9.0.45
  • apache tomcat 8.5.64, 9.0.44
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.53-1

debian advisories DEBIAN-CVE-2024-21733

  • tomcat8 Ubuntu Pro 18.04 LTS 8.5.39-1ubuntu1~18.04.3+esm5
  • tomcat9 Ubuntu Pro 18.04 LTS 9.0.16-3ubuntu0.18.04.2+esm7
  • tomcat9 Ubuntu Pro 20.04 LTS 9.0.31-1ubuntu0.9+esm2

ubuntu advisories UBUNTU-CVE-2024-21733

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tomcat SLES for SAP 12 SP5, SLES 12 SP5 9.0.36-3.121.1
  • tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.115-3.160.1

suse advisories SUSE-SU-2026:1058-1SUSE-SU-2024:0829-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-21733 updated cvss 5.3

tomcat: Leaking of unrelated request bodies in default error page

  • Red Hat build of Apache Camel 4.4.0 for Spring Boot
    fixed: vendor fix RHSA-2024:2707
  • Red Hat Fuse 7.13.0
    fixed: vendor fix RHSA-2024:3354
  • Red Hat A-MQ Clients 2 tomcat Red Hat AMQ Broker 7 tomcat Red Hat build of Apache Camel for Spring Boot 3 tomcat Red Hat Build of Keycloak tomcat Red Hat build of OptaPlanner 8 tomcat Red Hat Data Grid 8 tomcat
    +17 more products
    Red Hat Decision Manager 7 tomcat Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Enterprise Linux 8 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more Red Hat Enterprise Linux 9 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more Red Hat Integration Camel K 1 tomcat Red Hat JBoss Data Grid 7 tomcat Red Hat JBoss Enterprise Application Platform 6 tomcat, org.keycloak-keycloak-parent org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform 7 tomcat Red Hat JBoss Enterprise Application Platform 8 tomcat Red Hat JBoss Enterprise Application Platform Expansion Pack tomcat Red Hat JBoss Web Server 5 jws5-tomcat jws5-tomcat Red Hat JBoss Web Server 6 jws6-tomcat jws6-tomcat Red Hat Process Automation 7 tomcat Red Hat Single Sign-On 7 tomcat Red Hat support for Spring Boot tomcat Red Hat streams for Apache Kafka tomcat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

14.29% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat:tomcat-coyote
>=9.0.0-M11, <9.0.44
>=8.5.7, <8.5.64
9.0.44
8.5.64
maven org.apache.tomcat.embed:tomcat-embed-core
>=8.5.7, <8.5.64
>=9.0.0-M11, <9.0.44
8.5.64
9.0.44
maven org.apache.tomcat.experimental:tomcat-embed-programmatic
>=9.0.43, <9.0.44
9.0.44
bitnami tomcat
>=8.5.7, <8.5.98
>=9.0.0, <9.0.45
8.5.98
9.0.45

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.