CVE-2024-56337

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.

The mitigation for CVE-2024-50379 was incomplete.

Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:

• running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
• running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false)
• running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)

Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

Kodem intelligence

1. What is CVE-2024-56337? CVE-2024-56337 is a high-severity security vulnerability in org.apache.tomcat:tomcat-catalina (maven), affecting versions >= 11.0.0-M1, < 11.0.2. It is fixed in 11.0.2, 10.1.34, 9.0.98.
2. Which packages are affected by CVE-2024-56337?
   • org.apache.tomcat:tomcat-catalina (maven) (versions >= 11.0.0-M1, < 11.0.2)
   • org.apache.tomcat:tomcat-embed-core (maven) (versions >= 9.0.0.M1, < 9.0.98)
   • org.apache.tomcat.embed:tomcat-embed-core (maven) (versions >= 11.0.0-M1, < 11.0.2)
3. Is there a fix for CVE-2024-56337? Yes. CVE-2024-56337 is fixed in 11.0.2, 10.1.34, 9.0.98. Upgrade to this version or later.
4. Is CVE-2024-56337 exploitable, and should I be worried? Whether CVE-2024-56337 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2024-56337 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2024-56337?
   • Upgrade org.apache.tomcat:tomcat-catalina to 11.0.2 or later
   • Upgrade org.apache.tomcat:tomcat-catalina to 10.1.34 or later
   • Upgrade org.apache.tomcat:tomcat-embed-core to 9.0.98 or later
   • Upgrade org.apache.tomcat.embed:tomcat-embed-core to 11.0.2 or later
   • Upgrade org.apache.tomcat.embed:tomcat-embed-core to 10.1.34 or later
   • Upgrade org.apache.tomcat.embed:tomcat-embed-core to 9.0.98 or later

Other vulnerabilities in org.apache.tomcat:tomcat-catalina