Homepage

Improper Check for Unusual or Exceptional Conditions The advisory has been revoked - it doesn't affect any version of package tomcat-jsp-3.1-api  (opens in a new tab)

Threat Intelligence

EPSS
6.25% (94th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-TOMCATJSP31API-10588024
  • published3 Jul 2025
  • disclosed17 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 3 Jul 2025

CVE-2024-52316  (opens in a new tab)
CWE-754  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat-jsp-3.1-api package and not the tomcat-jsp-3.1-api package as distributed by AlmaLinux.

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.