CVE-2024-54677: Apache Tomcat DoS Vulnerability

CVE-2024-54677 Overview

CVE-2024-54677 is an Uncontrolled Resource Consumption vulnerability (CWE-400) affecting the examples web application provided with Apache Tomcat. This denial of service vulnerability allows remote attackers to exhaust server resources through the examples web application, potentially causing service disruption for legitimate users.

The vulnerability exists in multiple versions of Apache Tomcat across various release branches, including actively supported versions and several end-of-life releases. Exploitation requires no authentication or user interaction, making it particularly concerning for publicly exposed Tomcat instances that have not removed the examples web application.

Critical Impact

Remote attackers can trigger denial of service conditions by exploiting resource consumption flaws in the examples web application, potentially affecting availability of web applications hosted on vulnerable Tomcat servers.

Affected Products

• Apache Tomcat versions 11.0.0-M1 through 11.0.1
• Apache Tomcat versions 10.1.0-M1 through 10.1.33
• Apache Tomcat versions 9.0.0.M1 through 9.0.97
• Apache Tomcat versions 8.5.0 through 8.5.100 (EOL)
• NetApp Bootstrap OS
• NetApp HCI Compute Node

Discovery Timeline

• 2024-12-17 - CVE-2024-54677 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-54677

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), a category of flaws where an application fails to properly limit the resources it allocates in response to requests. In the context of Apache Tomcat's examples web application, this manifests as a failure to adequately constrain resource allocation when processing certain inputs.

The examples web application is included with Apache Tomcat for demonstration purposes and is not intended for production use. However, many deployments inadvertently leave this application accessible, creating an attack surface. An attacker can exploit this vulnerability remotely over the network without requiring any privileges or user interaction.

The impact of successful exploitation is limited to availability—no confidentiality or integrity compromise occurs. However, resource exhaustion can cause service degradation or complete denial of service for all applications hosted on the affected Tomcat instance.

Root Cause

The root cause of CVE-2024-54677 lies in insufficient resource consumption controls within the examples web application bundled with Apache Tomcat. The application fails to implement proper bounds checking or resource limits when processing requests, allowing attackers to trigger excessive resource allocation that can exhaust available system resources such as memory or CPU cycles.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication, privileges, or user interaction. An attacker can remotely send specially crafted requests to the examples web application endpoint, triggering uncontrolled resource consumption on the target server.

The examples web application typically resides at paths such as /examples/ on Tomcat installations. Attackers scanning for vulnerable instances can identify exposed examples applications and exploit this vulnerability to cause denial of service conditions.

Successful exploitation consumes server resources to the point where legitimate requests cannot be processed, resulting in service unavailability. The technical complexity of the attack is low, making it accessible to attackers with minimal expertise.

Detection Methods for CVE-2024-54677

Indicators of Compromise

• Unusual spike in requests targeting /examples/ or related paths on Apache Tomcat servers
• Abnormal resource consumption (memory, CPU) on Tomcat instances without corresponding legitimate traffic increase
• Service degradation or unavailability of web applications hosted on Tomcat servers
• Server log entries showing repeated requests to examples web application endpoints

Detection Strategies

• Monitor web server access logs for suspicious patterns of requests to the examples web application paths
• Implement anomaly detection for resource consumption metrics on Tomcat instances
• Deploy web application firewalls (WAF) with rules to detect and block resource exhaustion attack patterns
• Use application performance monitoring (APM) tools to identify unusual resource utilization trends

Monitoring Recommendations

• Configure alerting thresholds for CPU and memory utilization on Apache Tomcat servers
• Enable detailed access logging for the examples web application paths if they cannot be immediately removed
• Implement rate limiting on requests to the examples web application endpoint
• Review and audit Tomcat deployments to identify instances with examples web application enabled

How to Mitigate CVE-2024-54677

Immediate Actions Required

• Upgrade Apache Tomcat to patched versions: 11.0.2, 10.1.34, or 9.0.98
• Remove or disable the examples web application from production Tomcat deployments
• Restrict network access to Tomcat management interfaces and non-essential applications
• Apply rate limiting at the web server or load balancer level to reduce impact of potential attacks

Patch Information

Apache has released security patches addressing this vulnerability in the following versions:

Users running end-of-life versions (8.5.x and older) should upgrade to a supported branch as these versions will not receive official patches. Refer to the Apache Security Thread for official vendor guidance.

Additional security advisories are available from NetApp Security Advisory NTAP-20250131-0006 and Debian LTS Advisory 2025-07.

Workarounds

• Remove the examples web application entirely from production deployments by deleting the webapps/examples directory
• Configure firewall rules to block external access to the /examples/ path
• Deploy a reverse proxy or WAF with rules to restrict access to the examples web application
• Implement connection rate limiting to reduce the effectiveness of resource exhaustion attacks

# Remove examples web application from Apache Tomcat
rm -rf $CATALINA_HOME/webapps/examples

# Alternatively, restrict access via Tomcat configuration
# Add to server.xml within the appropriate Host element:
# <Context path="/examples" docBase="examples" privileged="false">
#   <Valve className="org.apache.catalina.valves.RemoteAddrValve"
#          allow="127\.0\.0\.1"/>
# </Context>