CVE-2024-52317

What it actually does

Incorrect recycling of request and response objects used by HTTP/2 requests in Apache Tomcat leads to potential mix-up of request or response data between different users.

Why it matters to the business

Sensitive user data from one session may be inadvertently exposed to another user, increasing risk of information leakage and compliance violations in web applications using affected Tomcat versions.

How an attack unfolds

An attacker interacts with an HTTP/2 endpoint on a vulnerable Tomcat instance, triggering improper object reuse that causes responses intended for one user to be delivered to another, potentially revealing session data or application responses.

How to fix it

Upgrade Apache Tomcat to version 11.0.0, 10.1.31, or 9.0.96. Apply the exact fixed versions listed for affected packages where provided, such as the git commit for apache/tomcat.

How to confirm the fix worked

Verify Tomcat version after upgrade, test HTTP/2 request handling under concurrent user load to confirm no cross-user data leakage occurs, and review release notes for the recycling fix.

Typical attack path

1. Identify a web application running a vulnerable Tomcat version with HTTP/2 enabled.
2. Send crafted or rapid HTTP/2 requests to trigger request/response object recycling.
3. Observe or capture responses that contain data belonging to other concurrent users.
4. Exploit the mixed-up data for information disclosure or session hijacking.

How to detect it

Review application and Tomcat access logs for concurrent HTTP/2 sessions showing mismatched user data or unexpected response contents; examine any available thread or connection pool debugging output for signs of object reuse across sessions.

What your security team should do

• Prioritize upgrade of all Tomcat instances matching the affected version ranges immediately.
• Disable HTTP/2 temporarily if upgrade cannot be applied quickly.
• Monitor for unusual response patterns in application logs during the remediation window.