---
id: CVE-2024-50379
title: >-
  Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP
  compilation in Apache Tomcat permits an RCE on case insensitive file systems
  when the default servlet is enabled for write (non-default configuration).


  This issu…
summary: >-
  Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP
  compilation in Apache Tomcat permits an RCE on case insensitive file systems
  when the default servlet is enabled for write (non-default configuration).


  This issu…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-367
vendor: apache
product: tomcat
affected:
  - 'tomcat >= 9.0.0, < 9.0.98'
  - 'tomcat >= 10.1.0, < 10.1.34'
  - 'tomcat >= 11.0.0, < 11.0.2'
  - bootstrap_os
patched:
  - tomcat 11.0.2
published: '2024-12-17'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:26.637'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-50379'
references:
  - url: 'https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2024/12/17/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2024/12/18/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250103-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2025-03-20T03:55:51.848287Z'
epss: 0.31824
epssPercentile: 0.9831
exploits:
  github: 15
  githubRepos:
    - 'https://github.com/v3153/CVE-2024-50379-POC'
    - 'https://github.com/yiliufeng168/CVE-2024-50379-POC'
    - 'https://github.com/JFOZ1010/Nuclei-Template-CVE-2024-50379'
  checkedAt: '2026-11-06T16:38:59.309Z'
ingestedAt: '2026-11-05T06:38:03.591Z'
---

## Overview

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

## Affected

- `tomcat >= 9.0.0, < 9.0.98`
- `tomcat >= 10.1.0, < 10.1.34`
- `tomcat >= 11.0.0, < 11.0.2`
- `bootstrap_os`

## Remediation

Upgrade past the affected range:

- `tomcat 11.0.2`