Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2024-52316 BIT-tomcat-2024-52316EUVD-2024-3331GHSA-xcpr-7mr4-h4xq

Apache Tomcat: Authentication bypass when using Jakarta Authentication API

Published Nov 18, 2024 · Updated Nov 4, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-catalina Package: tomcat10 Package: tomcat10 Package: tomcat8 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.

The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.0-M26, 10.1.0-M1 – ≤ 10.1.30, 9.0.0-M1 – ≤ 9.0.95, 8.5.0 – ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.31-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.31-1 —
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.34-0+deb12u1 DSA-5845-1
Debian 12 tomcat9 9.0.70-2 —
Debian 11 tomcat9 9.0.43-2~deb11u11 DLA-4017-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS tomcat10 10.1.16-1ubuntu0.1~esm3 —
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS tomcat8 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat +7 1:10.1.36-1.el10_0 RHSA-2025:7497
RHEL 9 tomcat +7 1:9.0.110-2.el9_8 RHSA-2026:18916
RHEL 8 tomcat +7 1:9.0.120-1.el8_10 RHSA-2026:68677
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.6 EUS tomcat +7 1:9.0.120-1.el9_6 RHSA-2026:68659
RHEL 9.4 E4S tomcat +7 1:9.0.120-1.el9_4 RHSA-2026:68679
RHEL 9.2 E4S tomcat +7 1:9.0.120-1.el9_2 RHSA-2026:68678
RHEL 8.8 TUS tomcat +7 1:9.0.120-1.el8_8 RHSA-2026:68680
RHEL 8.8 E4S tomcat +7 1:9.0.120-1.el8_8 RHSA-2026:68680
Red Hat JBoss Web Server 6 jws6-tomcat +9 10.1.36-6.redhat_00007.1.el8jws RHSA-2025:3608
Red Hat JBoss Web Server 6 jws6-tomcat-jakartaee-migration 1.0.6-2.redhat_00003.1.el8jws RHSA-2025:3608
Red Hat JBoss Web Server 6 jws6-tomcat-native 1.3.1-1.redhat_1.el8jws RHSA-2025:3608

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat +7 1:10.1.36-1.el10_0 ALSA-2025:7497
AlmaLinux 8 tomcat +7 1:9.0.120-1.el8_10 ALSA-2026:68677

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tomcat 1:10.1.36-1.el10_0 RLSA-2025:7497

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLES 15 SP6 tomcat10 10.1.33-150200.5.28.1 SUSE-SU-2024:4105-1
SLES 15 SP5 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLES 15 SP5 tomcat10 10.1.33-150200.5.28.1 SUSE-SU-2024:4105-1
SLES 15 SP4 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLES 15 SP3 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLES 15 SP2 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 tomcat 9.0.36-3.133.1 SUSE-SU-2026:1058-1, SUSE-SU-2024:4075-1
SLES for SAP 15 SP4 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLES for SAP 15 SP3 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLES for SAP 15 SP2 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLE HPC 15 SP4 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLE HPC 15 SP3 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SLE HPC 15 SP2 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SUSE Manager Server 4.3 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
SUSE Enterprise Storage 7.1 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.97-1.1 openSUSE-SU-2024:14525-1
openSUSE Tumbleweed tomcat10 10.1.33-1.1 openSUSE-SU-2024:14526-1
openSUSE Leap 15.6 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
openSUSE Leap 15.6 tomcat10 10.1.33-150200.5.28.1 SUSE-SU-2024:4105-1
openSUSE Leap 15.5 tomcat 9.0.97-150200.71.1 SUSE-SU-2024:4106-1
openSUSE Leap 15.5 tomcat10 10.1.33-150200.5.28.1 SUSE-SU-2024:4105-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.34-1.amzn2023.0.1 ALAS2023-2025-814
Amazon Linux 2023 tomcat9 +7 1:9.0.98-1.amzn2023.0.1 ALAS2023-2025-813

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tomcat +7 1:10.1.36-1.el10_0 ELSA-2025-7497

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-catalina < 9.0.96 9.0.96 GHSA-xcpr-7mr4-h4xq
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.30 10.1.30 GHSA-xcpr-7mr4-h4xq
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.1 11.0.1 GHSA-xcpr-7mr4-h4xq

Advisories 26

References