CVE-2024-52318: 
Java vulnerability analysis and mitigation

Incorrect object recycling and reuse vulnerability was discovered in Apache Tomcat affecting versions 11.0.0, 10.1.31, and 9.0.96. The vulnerability was disclosed on November 18, 2024, and users are recommended to upgrade to versions 11.0.1, 10.1.32, or 9.0.97 to address the issue (Apache Advisory).

The vulnerability is related to pooled JavaServer Pages (JSP) tags not being properly released after use, which could lead to incorrect object recycling and reuse. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating it is network accessible, requires low attack complexity, and needs user interaction (CISA-ADP).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information or addition or modification of data. The vulnerability has been classified with CWE-326 (Inadequate Encryption Strength) (NetApp Advisory).

The primary mitigation is to upgrade to the fixed versions: Apache Tomcat 11.0.1, 10.1.32, or 9.0.97. Note that while version 10.1.32 includes the fix, it was not officially released (OSS Security).