https://seclists.org/oss-sec/2024/q1/226: CVE-2024-23672: Apache Tomcat: WebSocket DoS with incomplete closing handshake
Published Mar 13, 2024
·Updated
Affected Software
1 affected component
Apache Tomcat
Frequently Asked Questions
1
What is CVE-2024-23672?
CVE-2024-23672 is a vulnerability in Apache Tomcat that can lead to a denial-of-service (DoS) condition due to an incomplete closing handshake in WebSocket communications.
2
What is the severity of CVE-2024-23672?
CVE-2024-23672 is classified as a high severity vulnerability, as it can be leveraged to disrupt service availability.
3
How do I fix CVE-2024-23672?
To fix CVE-2024-23672, upgrade to the latest version of Apache Tomcat that addresses this vulnerability.
4
Which versions of Apache Tomcat are affected by CVE-2024-23672?
CVE-2024-23672 affects multiple versions of Apache Tomcat, specifically those prior to the patched releases.
5
Are there any mitigations for CVE-2024-23672 before applying the fix?
Before applying the fix for CVE-2024-23672, consider limiting WebSocket connections or implementing rate limiting on your server.