CVE-2024-38286

What it actually does

Allocation of Resources Without Limits or Throttling in Apache Tomcat allows an attacker to trigger an OutOfMemoryError by abusing the TLS handshake process under certain configurations on any platform.

Why it matters to the business

Service disruption and downtime from server crashes due to memory exhaustion, affecting availability of web applications and requiring emergency restarts or scaling.

How an attack unfolds

An attacker repeatedly initiates TLS handshakes against a vulnerable Tomcat instance in configurations that lack proper resource limits, causing unbounded memory allocation until an OutOfMemoryError occurs and the server becomes unresponsive.

How to fix it

Upgrade Apache Tomcat to version 11.0.0-M21, 10.1.25, or 9.0.90. Apply the update across all affected installations and restart the service. Review and tighten TLS-related resource configuration where possible.

How to confirm the fix worked

Confirm the installed Tomcat version matches a fixed release, monitor JVM memory usage during simulated TLS handshake load, and verify absence of OutOfMemoryError events under normal traffic.

Typical attack path

1. Identify publicly reachable Tomcat instances with affected versions
2. Establish multiple TLS connections while crafting handshake sequences that trigger excessive memory use
3. Sustain the connection rate until memory is exhausted and the JVM crashes
4. Repeat or maintain pressure to prolong denial of service

How to detect it

Review Tomcat catalina.out and access logs for repeated TLS handshake activity followed by java.lang.OutOfMemoryError entries; correlate with JVM heap exhaustion metrics and sudden process restarts.

• java.lang.OutOfMemoryError
• catalina.out containing TLS handshake errors preceding JVM crash
• sudden spikes in memory usage during SSL handshake processing

What your security team should do

• Prioritize upgrade of all Tomcat instances to the listed fixed versions within the next maintenance window
• Enable resource limits and connection throttling for TLS handshakes as an interim control
• Monitor JVM heap usage and Tomcat access/error logs for anomalous handshake patterns
• Inventory all deployments to identify any remaining unsupported older versions