{"schema_version":"1.9.0","id":"BIT-tomcat-2024-21733","published":"2024-03-06T11:07:26.980Z","modified":"2026-09-08T08:48:20.894491748Z","aliases":["CVE-2024-21733","GHSA-f4qf-m5gf-8jm8"],"summary":"Apache Tomcat: Leaking of unrelated request bodies in default error page","details":"Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0 through 9.0.43. Other, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.","affected":[{"package":{"name":"tomcat","ecosystem":"Bitnami","purl":"pkg:bitnami/tomcat"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.7"},{"fixed":"8.5.98"},{"introduced":"9.0.0"},{"fixed":"9.0.45"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/tomcat/BIT-tomcat-2024-21733.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}],"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/176951/Apache-Tomcat-8.5.63-9.0.43-HTTP-Response-Smuggling.html"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2024/01/19/2"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240216-0005/"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21733"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html"}],"database_specific":{"cpes":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*"],"severity":"Medium"}}