The Apache Software Foundation (ASF) addressed an important vulnerability, tracked as CVE-2024-56337, in its Tomcat server software. The researchers warn that exploiting this vulnerability could result in remote code execution under certain conditions.

Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages (JSP), Jakarta Expression Language, and WebSocket technologies. It is developed by the Apache Software Foundation and is widely used as a web server and servlet container for running Java-based web applications.

The flaw is a TOCTOU race condition issue in Apache Tomcat that affects versions 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97. The vulnerability is due the incomplete mitigation for CVE-2024-50379 (CVSS score: 9.8).

‍