Apache Tomcat Resilience & CVE Suite

Suite Overview

Apache Tomcat's Java-based connector architecture (NIO / NIO2 / APR) handles high-throughput enterprise servlets. This suite validates thread pool reclamation, HTTP/2 stream state allocation, and WebSocket buffer safety under adversarial workloads.

HTTP/2 Stream DoS (CVE-2024-34750)

cve_2024_34750 — Evaluates Tomcat HTTP/2 stream manager limit handling without client window updates against unmanaged thread accumulation.

Incomplete Body Smuggling (CVE-2024-21733)

cve_2024_21733 — Sends incomplete HTTP request bodies to evaluate connection reuse and connector timeout state transitions.

HTTP/2 Stream Reset Race (CVE-2024-52316)

cve_2024_52316 — Tests race conditions during concurrent stream reset processing and resource deallocation.

HTTP/2 Stream Thread DoS (CVE-2025-53506)

cve_2025_53506 — Evaluates Tomcat HTTP/2 thread allocation limits under rapid bursts of unacknowledged streams.

HTTP/2 Priority Memory Leak (CVE-2025-31650)

cve_2025_31650 — Tests Tomcat HTTP/2 PRIORITY frame handling and dependency tree garbage collection.

WebSocket Slow Message Buffer DoS (CVE-2026-66299)

cve_2026_66299 — Drips partial WebSocket frames across concurrent connections to evaluate Tomcat buffer reclamation and memory limits.

Safe Execution

Tests are bound to your verified domain with automated latency and response code threshold monitoring.

Related simulations