Medium
Apache Tomcat: Leaking of unrelated request bodies in default error page
Type: advisorySources: OSV
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-21733
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 02:25 UTC · Revision 1
Source evidence
Apache Tomcat: Leaking of unrelated request bodies in default error page
core-osv · Original sourcePublished 19 Jan 2024, 10:29 UTC
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
osv:CVE-2024-21733
Complete source record
{
"id": "b20aa78b0e3f48953c1fc5526b4be9f6999ee7ef359ee031fa9da56964e7486b",
"url": "https://osv.dev/vulnerability/CVE-2024-21733",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Apache Tomcat: Leaking of unrelated request bodies in default error page",
"summary": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.",
"evidence": "osv:CVE-2024-21733",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-21733",
"aliases": [
"BIT-tomcat-2024-21733",
"CVE-2024-21733",
"GHSA-f4qf-m5gf-8jm8"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/tomcat",
"type": "GIT",
"events": [
{
"introduced": "b5205c92f41dfd9a67f78bc783db7b022e38226c"
},
{
"fixed": "c47f86adea090175669df8b2ca04c93050bcaf8c"
},
{
"introduced": "3c78e95e36268dfb76db1570f0cf49104fa6eabc"
},
{
"fixed": "7b4007a6a77300056f4681b064d7332c2284cbdd"
},
{
"introduced": "65ddc3a3872ea41ca67fec7b6834c704b6893361"
},
{
"last_affected": "35071e7e52f296b9187b054b0efd74121b7db3bd"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.5.7"
},
{
"fixed": "8.5.64"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.1"
},
{
"fixed": "9.0.44"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone11"
},
{
"last_affected": "9.0.0-milestone11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone12"
},
{
"last_affected": "9.0.0-milestone12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone13"
},
{
"last_affected": "9.0.0-milestone13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone14"
},
{
"last_affected": "9.0.0-milestone14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone15"
},
{
"last_affected": "9.0.0-milestone15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone16"
},
{
"last_affected": "9.0.0-milestone16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone17"
},
{
"last_affected": "9.0.0-milestone17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone18"
},
{
"last_affected": "9.0.0-milestone18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone19"
},
{
"last_affected": "9.0.0-milestone19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone20"
},
{
"last_affected": "9.0.0-milestone20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone21"
},
{
"last_affected": "9.0.0-milestone21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone22"
},
{
"last_affected": "9.0.0-milestone22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone23"
},
{
"last_affected": "9.0.0-milestone23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone24"
},
{
"last_affected": "9.0.0-milestone24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone25"
},
{
"last_affected": "9.0.0-milestone25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone26"
},
{
"last_affected": "9.0.0-milestone26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0-milestone27"
},
{
"last_affected": "9.0.0-milestone27"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"9.0.0-milestone11",
"9.0.0-milestone12",
"9.0.0-milestone13",
"9.0.0-milestone14",
"9.0.0-milestone15",
"9.0.0-milestone16",
"9.0.0-milestone17",
"9.0.0-milestone18",
"9.0.0-milestone19",
"9.0.0-milestone20",
"9.0.0-milestone21",
"9.0.0-milestone22",
"9.0.0-milestone23",
"9.0.0-milestone24",
"9.0.0-milestone25",
"9.0.0-milestone26",
"9.0.0-milestone27"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21733.json"
}
}
],
"modified": "2026-10-28T02:30:32.406251057Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21733.json",
"https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz",
"https://nvd.nist.gov/vuln/detail/CVE-2024-21733",
"https://security.netapp.com/advisory/ntap-20240216-0005/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-209"
],
"cna_assigner": "apache",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "8.5.7"
},
{
"last_affected": "8.5.63"
},
{
"introduced": "9.0.0-M11"
},
{
"last_affected": "9.0.43"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21733.json"
}
},
"related_cves": [
{
"value": "CVE-2024-21733",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499646,
"published_at": "2024-01-19T10:29:04.694+00:00"
}