Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2024-50379 BIT-tomcat-2024-50379EUVD-2024-3537GHSA-5j33-cvvr-w245

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

Published Dec 17, 2024 · Updated Nov 4, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-catalina Package: org.apache.tomcat.embed:tomcat-embed-core Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: tomcat10 Package: tomcat10 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.

The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.1, 10.1.0-M1 – ≤ 10.1.33, 9.0.0.M1 – ≤ 9.0.97, 8.5.0 – ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.34-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.34-1 —
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.34-0+deb12u1 DSA-5845-1
Debian 12 tomcat9 9.0.70-2 —
Debian 11 tomcat9 9.0.43-2~deb11u11 DLA-4017-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS tomcat9 No fix yet —
Ubuntu 25.10 tomcat9 No fix yet —
Ubuntu 24.04 LTS tomcat9 No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS tomcat10 10.1.16-1ubuntu0.1~esm3 USN-7705-1
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Ubuntu Pro 18.04 LTS tomcat9 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat9 +7 1:9.0.87-5.el10_0.1 RHSA-2025:11332
RHEL 9 tomcat +7 1:9.0.87-2.el9_5.1 RHSA-2025:3645
RHEL 8 tomcat +7 1:9.0.87-1.el8_10.3 RHSA-2025:3683
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS tomcat +7 1:9.0.87-1.el9_4.3 RHSA-2025:3647
RHEL 9.2 EUS pki-servlet-engine +1 1:9.0.50-1.el9_2.2 RHSA-2025:1920
RHEL 9.2 EUS tomcat +7 1:9.0.87-1.el9_2.3 RHSA-2025:3646
RHEL 8.8 EUS tomcat +7 1:9.0.87-1.el8_8.4 RHSA-2025:3684
Red Hat JBoss Web Server 6 jws6-tomcat +9 10.1.8-15.redhat_00022.1.el8jws RHSA-2025:0342
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.87-6.redhat_00006.1.el7jws RHSA-2025:0361

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat9 +7 1:9.0.87-5.el10_0.1 ALSA-2025:11332
AlmaLinux 9 tomcat +7 1:9.0.87-2.el9_5.1 ALSA-2025:11335, ALSA-2025:3645
AlmaLinux 8 tomcat +7 1:9.0.87-1.el8_10.3 ALSA-2025:11333, ALSA-2025:3683

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 tomcat 1:9.0.87-2.el9_5.1 RLSA-2025:3645
Rocky Linux 8 tomcat 1:9.0.87-1.el8_10.3 RLSA-2025:3683

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLES 15 SP6 tomcat10 10.1.34-150200.5.31.1 SUSE-SU-2025:0033-1
SLES 15 SP5 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLES 15 SP5 tomcat10 10.1.34-150200.5.31.1 SUSE-SU-2025:0033-1
SLES 15 SP4 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLES 15 SP3 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLES 12 SP5 tomcat 9.0.36-3.136.1 SUSE-SU-2026:1058-1, SUSE-SU-2025:0394-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLES for SAP 15 SP5 tomcat10 10.1.34-150200.5.31.1 SUSE-SU-2025:0033-1
SLES for SAP 15 SP4 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLES for SAP 15 SP3 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLE HPC 15 SP5 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLE HPC 15 SP5 tomcat10 10.1.34-150200.5.31.1 SUSE-SU-2025:0033-1
SLE HPC 15 SP4 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SLE HPC 15 SP3 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SUSE Manager Server 4.3 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
SUSE Enterprise Storage 7.1 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.98-1.1 openSUSE-SU-2025:14622-1
openSUSE Tumbleweed tomcat10 10.1.34-1.1 openSUSE-SU-2025:14623-1
openSUSE Leap 15.6 tomcat 9.0.98-150200.74.1 SUSE-SU-2025:0058-1
openSUSE Leap 15.6 tomcat10 10.1.34-150200.5.31.1 SUSE-SU-2025:0033-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.34-1.amzn2023.0.1 ALAS2023-2025-814
Amazon Linux 2023 tomcat9 +7 1:9.0.98-1.amzn2023.0.1 ALAS2023-2025-813

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 tomcat +7 1:9.0.87-2.el9_5.1 ELSA-2025-3645
Oracle Linux 8 tomcat +7 1:9.0.87-1.el8_10.3 ELSA-2025-3683

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling thingsboard +4 3.9-r1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 15 repositories · most starred shown

  • SleepingBag945/CVE-2024-50379 ★ 84 · Dec 23, 2024

    tomcat CVE-2024-50379/CVE-2024-56337 条件竞争文件上传exp

  • ph0ebus/Tomcat-CVE-2024-50379-Poc ★ 57 · Dec 21, 2024

    RCE through a race condition in Apache Tomcat

  • iSee857/CVE-2024-50379-PoC ★ 24 · Dec 20, 2024

    Apache Tomcat（CVE-2024-50379）条件竞争致远程代码执行漏洞批量检测脚本

  • dragonked2/CVE-2024-50379-POC ★ 4 · Dec 25, 2024

    This repository contains a Python script designed to exploit CVE-2024-50379, a vulnerability that allows attackers to upload a JSP shell to a vulnerable server and execute arbitrary commands remotely…

  • v3153/CVE-2024-50379-POC ★ 4 · Dec 18, 2024
  • pwnosec/CVE-2024-50379 ★ 2 · Jan 23, 2025

    ExploitDB CVE-2024-50379 a vulnerability that enables attackers to upload a JSP shell to a vulnerable server and execute commands remotely. The exploit is especially effective when the /uploads direc…

  • JFOZ1010/Nuclei-Template-CVE-2024-50379 ★ 2 · Dec 20, 2024

    Repositorio para alojar un template de Nuclei para probar el CVE-2024-50379 (en fase de prueba)

  • dear-cell/CVE-2024-50379 ★ 1 · Dec 23, 2024

    CVE-2024-50379利用

  • Alchemist3dot14/CVE-2024-50379 ★ 1 · Dec 20, 2024

    CVE-2024-50379 is a critical vulnerability affecting multiple versions of Apache Tomcat, an open source web server and servlet container widely used for deploying Java-based web applications. The vul…

  • yiliufeng168/CVE-2024-50379-POC ★ 1 · Dec 19, 2024

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.2 11.0.2 GHSA-5j33-cvvr-w245
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.34 10.1.34 GHSA-5j33-cvvr-w245
Maven org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.98 9.0.98 GHSA-5j33-cvvr-w245
Maven org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100 — GHSA-5j33-cvvr-w245
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.2 11.0.2 GHSA-5j33-cvvr-w245
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.34 10.1.34 GHSA-5j33-cvvr-w245
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.98 9.0.98 GHSA-5j33-cvvr-w245
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 — GHSA-5j33-cvvr-w245

Advisories 33

References