NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Maven

CVE-2024-52316: Apache Tomcat - Authentication Bypass

criticalCVSS 3.1 9.8GHSA-xcpr-7mr4-h4xq

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process.

Published Nov 18, 2024 · Updated Nov 3, 2025

Affected packages

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
< 9.0.96
Fixed in
9.0.96
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 10.1.0-M1, < 10.1.30
Fixed in
10.1.30
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 11.0.0-M1, <= 11.0.0-M26
Fixed in
11.0.1
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100.

Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries