Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-48976 (GCVE-0-2025-48976)
Vulnerability from cvelistv5
Published
2025-06-16 15:00
Modified
2025-06-17 14:07
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Allocation of resources with insufficient limits
Summary
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
References
▼ | URL | Tags | |
---|---|---|---|
security@apache.org | https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12 | Mailing List, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2025/06/16/4 | Mailing List, Third Party Advisory |
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Apache Software Foundation | Apache Commons FileUpload |
Version: 1.0 ≤ |
||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2025-06-16T20:03:22.449Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "url": "http://www.openwall.com/lists/oss-security/2025/06/16/4" } ], "title": "CVE Program Container" }, { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-48976", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-06-17T14:04:56.145891Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-06-17T14:07:34.067Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "commons-fileupload:commons-fileupload", "product": "Apache Commons FileUpload", "vendor": "Apache Software Foundation", "versions": [ { "lessThan": "1.6", "status": "affected", "version": "1.0", "versionType": "semver" } ] }, { "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.commons:commons-fileupload2", "product": "Apache Commons FileUpload", "vendor": "Apache Software Foundation", "versions": [ { "lessThan": "2.0.0-M4", "status": "affected", "version": "2.0.0-M1", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "TERASOLUNA Framework Security Team of NTT DATA Group Corporation" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.\u003c/p\u003e" } ], "value": "Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue." } ], "metrics": [ { "other": { "content": { "text": "important" }, "type": "Textual description of severity" } } ], "problemTypes": [ { "descriptions": [ { "description": "Allocation of resources with insufficient limits", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-06-16T15:00:48.140Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "source": { "discovery": "EXTERNAL" }, "title": "Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2025-48976", "datePublished": "2025-06-16T15:00:48.140Z", "dateReserved": "2025-05-29T07:19:14.431Z", "dateUpdated": "2025-06-17T14:07:34.067Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2025-48976\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2025-06-16T15:15:24.460\",\"lastModified\":\"2025-07-15T14:21:41.997\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\\n\\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\\n\\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.\"},{\"lang\":\"es\",\"value\":\"La asignaci\u00f3n de recursos para encabezados multiparte con l\u00edmites insuficientes gener\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en Apache Commons FileUpload. Este problema afecta a Apache Commons FileUpload: de la versi\u00f3n 1.0 a la 1.6; de la versi\u00f3n 2.0.0-M1 a la 2.0.0-M4. Se recomienda actualizar a las versiones 1.6 o 2.0.0-M4, que solucionan el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0\",\"versionEndExcluding\":\"1.6\",\"matchCriteriaId\":\"20D93D43-A57F-4C1E-82AC-EB50648742EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:commons_fileupload:2.0.0:m1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B415BCF-AACF-4882-8882-10D99610C79D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:commons_fileupload:2.0.0:m1-rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB892667-4AF8-41C6-9F40-D800CA16A8C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AE1594A-1C38-461E-B949-76A0C24A3C7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:commons_fileupload:2.0.0:m2-rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"827AA598-1A62-4529-A7C7-37EB9D56BE6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:commons_fileupload:2.0.0:m3:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA5C9AC9-56E6-4864-9965-827C93755F8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:commons_fileupload:2.0.0:m3-rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2395D9D-DEF6-4CC7-87F9-6D8FC9DCEE74\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/06/16/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}", "vulnrichment": { "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-48976\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-17T14:04:56.145891Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2025-06-17T14:05:58.653Z\"}}], \"cna\": {\"title\": \"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"TERASOLUNA Framework Security Team of NTT DATA Group Corporation\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Commons FileUpload\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0\", \"lessThan\": \"1.6\", \"versionType\": \"semver\"}], \"packageName\": \"commons-fileupload:commons-fileupload\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Commons FileUpload\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0-M1\", \"lessThan\": \"2.0.0-M4\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.commons:commons-fileupload2\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\\n\\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\\n\\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Allocation of resources with insufficient limits\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2025-06-16T15:00:48.140Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2025-48976\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-16T20:03:22.449Z\", \"dateReserved\": \"2025-05-29T07:19:14.431Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2025-06-16T15:00:48.140Z\", \"assignerShortName\": \"apache\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1" } } }
wid-sec-w-2025-1334
Vulnerability from csaf_certbund
Published
2025-06-16 22:00
Modified
2025-09-09 22:00
Summary
Apache Commons FileUpload: Schwachstelle ermöglicht Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Apache Commons ist ein Apache-Projekt, das alle Aspekte der wiederverwendbaren Java-Komponenten behandelt.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Commons FileUpload ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Apache Commons ist ein Apache-Projekt, das alle Aspekte der wiederverwendbaren Java-Komponenten behandelt.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Commons FileUpload ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2025-1334 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1334.json" }, { "category": "self", "summary": "WID-SEC-2025-1334 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1334" }, { "category": "external", "summary": "Mailing list OSS Security vom 2025-06-16", "url": "https://seclists.org/oss-sec/2025/q2/255" }, { "category": "external", "summary": "GitHub Security Advisory GHSA-vv7r-c36w-3prj vom 2025-06-16", "url": "https://github.com/advisories/GHSA-vv7r-c36w-3prj" }, { "category": "external", "summary": "Red Hat Bugtracker #2373020 vom 2025-06-16", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "PoC CVE-2025-48988 \u0026 CVE-2025-48976 vom 2025-06-20", "url": "https://github.com/Samb102/POC-CVE-2025-48988-CVE-2025-48976" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:02159-1 vom 2025-06-27", "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-June/021698.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:02184-1 vom 2025-07-01", "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-July/021733.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS2-2025-2920 vom 2025-07-10", "url": "https://alas.aws.amazon.com/AL2/ALAS2-2025-2920.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS2TOMCAT9-2025-020 vom 2025-07-10", "url": "https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2025-020.html" }, { "category": "external", "summary": "IBM Security Bulletin 7239768 vom 2025-07-15", "url": "https://www.ibm.com/support/pages/node/7239768" }, { "category": "external", "summary": "IBM Security Bulletin 7239757 vom 2025-07-15", "url": "https://www.ibm.com/support/pages/node/7239757" }, { "category": "external", "summary": "Atlassian Security Bulletin - July 15 2025", "url": "https://confluence.atlassian.com/security/security-bulletin-july-15-2025-1590658642.html" }, { "category": "external", "summary": "F5 Security Advisory K000152614 vom 2025-07-17", "url": "https://my.f5.com/manage/s/article/K000152614" }, { "category": "external", "summary": "Debian Security Advisory DLA-4245 vom 2025-07-22", "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html" }, { "category": "external", "summary": "Debian Security Advisory DLA-4244 vom 2025-07-22", "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:11695 vom 2025-07-28", "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:11696 vom 2025-07-28", "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "category": "external", "summary": "Absolute Security Information vom 2025-07-30", "url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1356" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:11741 vom 2025-07-30", "url": "https://access.redhat.com/errata/RHSA-2025:11741" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:11742 vom 2025-07-30", "url": "https://access.redhat.com/errata/RHSA-2025:11742" }, { "category": "external", "summary": "HCL Security Bulletin vom 2025-08-05", "url": "https://support.hcl-software.com/community?id=community_blog\u0026sys_id=4cd4383f3bcb26d828f8f547f4e45af6" }, { "category": "external", "summary": "IBM Security Bulletin 7242088 vom 2025-08-13", "url": "https://www.ibm.com/support/pages/node/7242088" }, { "category": "external", "summary": "IBM Security Bulletin 7242150 vom 2025-08-14", "url": "https://www.ibm.com/support/pages/node/7242150" }, { "category": "external", "summary": "IBM Security Bulletin 7242269 vom 2025-08-15", "url": "https://www.ibm.com/support/pages/node/7242269" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14183 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14181 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2025-14177 vom 2025-08-21", "url": "https://linux.oracle.com/errata/ELSA-2025-14177.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14178 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14179 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14182 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14180 vom 2025-08-21", "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14177 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2025-14181 vom 2025-08-21", "url": "https://linux.oracle.com/errata/ELSA-2025-14181.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2025-14178 vom 2025-08-21", "url": "https://linux.oracle.com/errata/ELSA-2025-14178.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2025-14179 vom 2025-08-22", "url": "https://linux.oracle.com/errata/ELSA-2025-14179.html" }, { "category": "external", "summary": "IBM Security Bulletin 7243542 vom 2025-08-29", "url": "https://www.ibm.com/support/pages/node/7243542" }, { "category": "external", "summary": "IBM Security Bulletin 7243781 vom 2025-09-02", "url": "https://www.ibm.com/support/pages/node/7243781" }, { "category": "external", "summary": "Rocky Linux Security Advisory RLSA-2025:14177 vom 2025-09-08", "url": "https://errata.build.resf.org/RLSA-2025:14177" }, { "category": "external", "summary": "IBM Security Bulletin 7244395 vom 2025-09-09", "url": "https://www.ibm.com/support/pages/node/7244395" } ], "source_lang": "en-US", "title": "Apache Commons FileUpload: Schwachstelle erm\u00f6glicht Denial of Service", "tracking": { "current_release_date": "2025-09-09T22:00:00.000+00:00", "generator": { "date": "2025-09-10T05:07:04.311+00:00", "engine": { "name": "BSI-WID", "version": "1.4.0" } }, "id": "WID-SEC-W-2025-1334", "initial_release_date": "2025-06-16T22:00:00.000+00:00", "revision_history": [ { "date": "2025-06-16T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2025-06-19T22:00:00.000+00:00", "number": "2", "summary": "PoC aufgenommen" }, { "date": "2025-06-29T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2025-07-01T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2025-07-10T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2025-07-15T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2025-07-17T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von F5 aufgenommen" }, { "date": "2025-07-21T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2025-07-28T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2025-07-29T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates aufgenommen" }, { "date": "2025-07-30T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2025-08-05T22:00:00.000+00:00", "number": "12", "summary": "Neue Updates von HCL aufgenommen" }, { "date": "2025-08-13T22:00:00.000+00:00", "number": "13", "summary": "Neue Updates von IBM und IBM-APAR aufgenommen" }, { "date": "2025-08-14T22:00:00.000+00:00", "number": "14", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2025-08-20T22:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen" }, { "date": "2025-08-21T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2025-08-24T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2025-08-28T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2025-09-02T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2025-09-08T22:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen" }, { "date": "2025-09-09T22:00:00.000+00:00", "number": "21", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "21" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c13.56", "product": { "name": "Absolute Secure Access \u003c13.56", "product_id": "T045729" } }, { "category": "product_version", "name": "13.56", "product": { "name": "Absolute Secure Access 13.56", "product_id": "T045729-fixed", "product_identification_helper": { "cpe": "cpe:/a:absolute:secure_access:13.56" } } } ], "category": "product_name", "name": "Secure Access" } ], "category": "vendor", "name": "Absolute" }, { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "FileUpload \u003c1.6", "product": { "name": "Apache Commons FileUpload \u003c1.6", "product_id": "T044646" } }, { "category": "product_version", "name": "FileUpload 1.6", "product": { "name": "Apache Commons FileUpload 1.6", "product_id": "T044646-fixed", "product_identification_helper": { "cpe": "cpe:/a:apache:commons:1.6::fileupload" } } }, { "category": "product_version_range", "name": "FileUpload \u003c2.0.0-M4", "product": { "name": "Apache Commons FileUpload \u003c2.0.0-M4", "product_id": "T044647" } }, { "category": "product_version", "name": "FileUpload 2.0.0-M4", "product": { "name": "Apache Commons FileUpload 2.0.0-M4", "product_id": "T044647-fixed", "product_identification_helper": { "cpe": "cpe:/a:apache:commons:2.0.0-m4::fileupload" } } } ], "category": "product_name", "name": "Commons" } ], "category": "vendor", "name": "Apache" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c11.0.3", "product": { "name": "Atlassian Bamboo \u003c11.0.3", "product_id": "T045447" } }, { "category": "product_version", "name": "11.0.3", "product": { "name": "Atlassian Bamboo 11.0.3", "product_id": "T045447-fixed", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bamboo:11.0.3" } } }, { "category": "product_version_range", "name": "\u003c10.2.6 (LTS)", "product": { "name": "Atlassian Bamboo \u003c10.2.6 (LTS)", "product_id": "T045448" } }, { "category": "product_version", "name": "10.2.6 (LTS)", "product": { "name": "Atlassian Bamboo 10.2.6 (LTS)", "product_id": "T045448-fixed", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bamboo:10.2.6_%28lts%29" } } }, { "category": "product_version_range", "name": "\u003c9.6.15 (LTS)", "product": { "name": "Atlassian Bamboo \u003c9.6.15 (LTS)", "product_id": "T045449" } }, { "category": "product_version", "name": "9.6.15 (LTS)", "product": { "name": "Atlassian Bamboo 9.6.15 (LTS)", "product_id": "T045449-fixed", "product_identification_helper": { "cpe": "cpe:/a:atlassian:bamboo:9.6.15_%28lts%29" } } } ], "category": "product_name", "name": "Bamboo" } ], "category": "vendor", "name": "Atlassian" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP", "product": { "name": "F5 BIG-IP", "product_id": "T001663", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip:-" } } } ], "category": "vendor", "name": "F5" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c9.1.18.2", "product": { "name": "HCL Commerce \u003c9.1.18.2", "product_id": "T045896" } }, { "category": "product_version", "name": "9.1.18.2", "product": { "name": "HCL Commerce 9.1.18.2", "product_id": "T045896-fixed", "product_identification_helper": { "cpe": "cpe:/a:hcltechsw:commerce:9.1.18.2" } } } ], "category": "product_name", "name": "Commerce" } ], "category": "vendor", "name": "HCL" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "11", "product": { "name": "IBM DevOps Code ClearCase 11.0", "product_id": "T046313", "product_identification_helper": { "cpe": "cpe:/a:ibm:devops_code_clearcase:11.0" } } } ], "category": "product_name", "name": "DevOps Code ClearCase" }, { "branches": [ { "category": "product_version", "name": "9", "product": { "name": "IBM InfoSphere Identity Insight 9.0", "product_id": "723109", "product_identification_helper": { "cpe": "cpe:/a:ibm:infosphere_identity_insight:9.0" } } }, { "category": "product_version", "name": "9.1", "product": { "name": "IBM InfoSphere Identity Insight 9.1", "product_id": "T024310", "product_identification_helper": { "cpe": "cpe:/a:ibm:infosphere_identity_insight:9.1" } } }, { "category": "product_version", "name": "10", "product": { "name": "IBM InfoSphere Identity Insight 10.0", "product_id": "T024311", "product_identification_helper": { "cpe": "cpe:/a:ibm:infosphere_identity_insight:10.0" } } } ], "category": "product_name", "name": "InfoSphere Identity Insight" }, { "branches": [ { "category": "product_version", "name": "for z/OS 10.1.0.0-10.1.0.5", "product": { "name": "IBM Integration Bus for z/OS 10.1.0.0-10.1.0.5", "product_id": "T046252", "product_identification_helper": { "cpe": "cpe:/a:ibm:integration_bus:10.1.0.0_-_10.1.0.5::zos" } } } ], "category": "product_name", "name": "Integration Bus" }, { "category": "product_name", "name": "IBM QRadar SIEM", "product": { "name": "IBM QRadar SIEM", "product_id": "T021415", "product_identification_helper": { "cpe": "cpe:/a:ibm:qradar_siem:-" } } }, { "branches": [ { "category": "product_version", "name": "9.1", "product": { "name": "IBM Rational ClearCase 9.1", "product_id": "T021423", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearcase:9.1" } } }, { "category": "product_version", "name": "10.0.0", "product": { "name": "IBM Rational ClearCase 10.0.0", "product_id": "T026520", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearcase:10.0.0" } } } ], "category": "product_name", "name": "Rational ClearCase" }, { "category": "product_name", "name": "IBM Tivoli Key Lifecycle Manager", "product": { "name": "IBM Tivoli Key Lifecycle Manager", "product_id": "T026238", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_key_lifecycle_manager:-" } } }, { "branches": [ { "category": "product_version_range", "name": "IP Edition \u003c4.2 Fix Pack 23", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c4.2 Fix Pack 23", "product_id": "T046654" } }, { "category": "product_version", "name": "IP Edition 4.2 Fix Pack 23", "product": { "name": "IBM Tivoli Network Manager IP Edition 4.2 Fix Pack 23", "product_id": "T046654-fixed", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition___4.2_fix_pack_23" } } } ], "category": "product_name", "name": "Tivoli Network Manager" }, { "branches": [ { "category": "product_version", "name": "8.5", "product": { "name": "IBM WebSphere Application Server 8.5", "product_id": "703851", "product_identification_helper": { "cpe": "cpe:/a:ibm:websphere_application_server:8.5" } } }, { "category": "product_version", "name": "9", "product": { "name": "IBM WebSphere Application Server 9.0", "product_id": "703852", "product_identification_helper": { "cpe": "cpe:/a:ibm:websphere_application_server:9.0" } } }, { "category": "product_version", "name": "Liberty 17.0.0.3-25.0.0.8", "product": { "name": "IBM WebSphere Application Server Liberty 17.0.0.3-25.0.0.8", "product_id": "T046203", "product_identification_helper": { "cpe": "cpe:/a:ibm:websphere_application_server:17.0.0.3_-_25.0.0.8::liberty" } } } ], "category": "product_name", "name": "WebSphere Application Server" }, { "branches": [ { "category": "product_version", "name": "8.5", "product": { "name": "IBM WebSphere Service Registry and Repository 8.5", "product_id": "306235", "product_identification_helper": { "cpe": "cpe:/a:ibm:websphere_service_registry_and_repository:8.5" } } } ], "category": "product_name", "name": "WebSphere Service Registry and Repository" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "RESF Rocky Linux", "product": { "name": "RESF Rocky Linux", "product_id": "T032255", "product_identification_helper": { "cpe": "cpe:/o:resf:rocky_linux:-" } } } ], "category": "vendor", "name": "RESF" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c6.1.1", "product": { "name": "Red Hat JBoss Web Server \u003c6.1.1", "product_id": "T045760" } }, { "category": "product_version", "name": "6.1.1", "product": { "name": "Red Hat JBoss Web Server 6.1.1", "product_id": "T045760-fixed", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1.1" } } } ], "category": "product_name", "name": "JBoss Web Server" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "product_status": { "known_affected": [ "67646", "T004914", "703851", "703852", "T045448", "T045447", "T045449", "T021415", "T001663", "398363", "T046252", "T046313", "T045760", "T046654", "T026520", "T045729", "T032255", "723109", "T021423", "T045896", "2951", "T002207", "T044647", "T044646", "T024311", "T024310", "T026238", "T046203", "306235" ] }, "release_date": "2025-06-16T22:00:00.000+00:00", "title": "CVE-2025-48976" } ] }
rhsa-2025:14179
Vulnerability from csaf_redhat
Published
2025-08-20 15:36
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14179", "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14179.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-09-26T06:41:16+00:00", "generator": { "date": "2025-09-26T06:41:16+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:14179", "initial_release_date": "2025-08-20T15:36:15+00:00", "revision_history": [ { "date": "2025-08-20T15:36:15+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:36:15+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:16+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10.0" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:10.1.36-1.el10_0.2.src", "product": { "name": "tomcat-1:10.1.36-1.el10_0.2.src", "product_id": "tomcat-1:10.1.36-1.el10_0.2.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@10.1.36-1.el10_0.2?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-5.0-api@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-3.1-api@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-6.0-api@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:10.1.36-1.el10_0.2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src" }, "product_reference": "tomcat-1:10.1.36-1.el10_0.2.src", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14180
Vulnerability from csaf_redhat
Published
2025-08-20 15:43
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14180", "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14180.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-09-26T06:41:18+00:00", "generator": { "date": "2025-09-26T06:41:18+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:14180", "initial_release_date": "2025-08-20T15:43:40+00:00", "revision_history": [ { "date": "2025-08-20T15:43:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:43:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:18+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el9_4.6.src", "product": { "name": "tomcat-1:9.0.87-1.el9_4.6.src", "product_id": "tomcat-1:9.0.87-1.el9_4.6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el9_4.6?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el9_4.6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src" }, "product_reference": "tomcat-1:9.0.87-1.el9_4.6.src", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14182
Vulnerability from csaf_redhat
Published
2025-08-20 15:36
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14182", "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14182.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-09-26T06:41:17+00:00", "generator": { "date": "2025-09-26T06:41:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:14182", "initial_release_date": "2025-08-20T15:36:45+00:00", "revision_history": [ { "date": "2025-08-20T15:36:45+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:36:45+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product": { "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el8_8.7.src", "product": { "name": "tomcat-1:9.0.87-1.el8_8.7.src", "product_id": "tomcat-1:9.0.87-1.el8_8.7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_8.7?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_8.7.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src" }, "product_reference": "tomcat-1:9.0.87-1.el8_8.7.src", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_8.7.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src" }, "product_reference": "tomcat-1:9.0.87-1.el8_8.7.src", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14178
Vulnerability from csaf_redhat
Published
2025-08-20 15:33
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: tomcat9 security update
Notes
Topic
An update for tomcat9 is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat9 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14178", "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14178.json" } ], "title": "Red Hat Security Advisory: tomcat9 security update", "tracking": { "current_release_date": "2025-09-26T06:41:16+00:00", "generator": { "date": "2025-09-26T06:41:16+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:14178", "initial_release_date": "2025-08-20T15:33:55+00:00", "revision_history": [ { "date": "2025-08-20T15:33:55+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:33:55+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:16+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10.0" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat9-1:9.0.87-5.el10_0.3.src", "product": { "name": "tomcat9-1:9.0.87-5.el10_0.3.src", "product_id": "tomcat9-1:9.0.87-5.el10_0.3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9@9.0.87-5.el10_0.3?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat9-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-admin-webapps@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-docs-webapp@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-el-3.0-api@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-jsp-2.3-api@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-lib@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-servlet-4.0-api@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-webapps@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat9-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-1:9.0.87-5.el10_0.3.src as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src" }, "product_reference": "tomcat9-1:9.0.87-5.el10_0.3.src", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14177
Vulnerability from csaf_redhat
Published
2025-08-20 15:37
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14177", "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14177.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-09-26T06:41:15+00:00", "generator": { "date": "2025-09-26T06:41:15+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:14177", "initial_release_date": "2025-08-20T15:37:48+00:00", "revision_history": [ { "date": "2025-08-20T15:37:48+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:37:48+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:15+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el8_10.6.src", "product": { "name": "tomcat-1:9.0.87-1.el8_10.6.src", "product_id": "tomcat-1:9.0.87-1.el8_10.6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_10.6?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_10.6.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src" }, "product_reference": "tomcat-1:9.0.87-1.el8_10.6.src", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:11695
Vulnerability from csaf_redhat
Published
2025-07-28 13:54
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update
Notes
Topic
An update is now available for Red Hat JBoss Web Server 5.8 on Red Hat Enterprise Linux versions 7, 8, and 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.8.5 serves as a replacement for Red Hat JBoss Web Server 5.8.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload [jws-5] (CVE-2025-48988)
* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-5] (CVE-2025-49125)
* tomcat: Apache Commons FileUpload DoS via part headers [jws-5] (CVE-2025-48976)
* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52520)
* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52434)
* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat JBoss Web Server 5.8 on Red Hat Enterprise Linux versions 7, 8, and 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.8.5 serves as a replacement for Red Hat JBoss Web Server 5.8.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload [jws-5] (CVE-2025-48988)\n* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-5] (CVE-2025-49125)\n* tomcat: Apache Commons FileUpload DoS via part headers [jws-5] (CVE-2025-48976)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52520)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52434)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:11695", "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index", "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11695.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update", "tracking": { "current_release_date": "2025-09-26T06:41:00+00:00", "generator": { "date": "2025-09-26T06:41:00+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:11695", "initial_release_date": "2025-07-28T13:54:01+00:00", "revision_history": [ { "date": "2025-07-28T13:54:01+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-07-28T13:54:01+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:00+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product": { "name": "Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el7" } } }, { "category": "product_name", "name": "Red Hat JBoss Web Server 5.8 for RHEL 8", "product": { "name": "Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el8" } } }, { "category": "product_name", "name": "Red Hat JBoss Web Server 5.8 for RHEL 9", "product": { "name": "Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el9" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server" }, { "branches": [ { "category": "product_version", "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "product": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el7jws?arch=src" } } }, { "category": "product_version", "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "product": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el8jws?arch=src" } } }, { "category": "product_version", "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "product": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el9jws?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-java-jdk11@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-java-jdk8@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product": { "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_id": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.87-12.redhat_00011.1.el7jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product": { "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_id": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.87-12.redhat_00011.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product": { "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_id": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.87-12.redhat_00011.1.el9jws?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src" }, "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server", "product_id": "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch" }, "product_reference": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "relates_to_product_reference": "7Server-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src" }, "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8", "product_id": "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch" }, "product_reference": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src" }, "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9", "product_id": "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" }, "product_reference": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-5.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:54:01+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:54:01+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:54:01+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:54:01+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11695" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:54:01+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:54:01+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src", "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src", "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src", "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch", "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14183
Vulnerability from csaf_redhat
Published
2025-08-20 15:40
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14183", "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14183.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-09-26T06:41:18+00:00", "generator": { "date": "2025-09-26T06:41:18+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:14183", "initial_release_date": "2025-08-20T15:40:30+00:00", "revision_history": [ { "date": "2025-08-20T15:40:30+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:40:30+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:18+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el9_2.6.src", "product": { "name": "tomcat-1:9.0.87-1.el9_2.6.src", "product_id": "tomcat-1:9.0.87-1.el9_2.6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el9_2.6?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el9_2.6.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src" }, "product_reference": "tomcat-1:9.0.87-1.el9_2.6.src", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:11741
Vulnerability from csaf_redhat
Published
2025-07-30 15:51
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update
Notes
Topic
Red Hat JBoss Web Server 6.1.1 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 6.1.1 serves as a replacement for Red Hat JBoss Web Server 6.1.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload [jws-6] (CVE-2025-48988)
* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-6] (CVE-2025-49125)
* tomcat: Apache Commons FileUpload DoS via part headers [jws-6] (CVE-2025-48976)
* jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Web Server 6.1.1 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 6.1.1 serves as a replacement for Red Hat JBoss Web Server 6.1.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload [jws-6] (CVE-2025-48988)\n* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-6] (CVE-2025-49125)\n* tomcat: Apache Commons FileUpload DoS via part headers [jws-6] (CVE-2025-48976)\n* jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:11741", "url": "https://access.redhat.com/errata/RHSA-2025:11741" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_1_release_notes/index", "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_1_release_notes/index" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11741.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update", "tracking": { "current_release_date": "2025-09-26T06:41:00+00:00", "generator": { "date": "2025-09-26T06:41:00+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:11741", "initial_release_date": "2025-07-30T15:51:38+00:00", "revision_history": [ { "date": "2025-07-30T15:51:38+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-07-30T15:51:38+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:00+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 6.1 for RHEL 10", "product": { "name": "Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el10" } } }, { "category": "product_name", "name": "Red Hat JBoss Web Server 6.1 for RHEL 8", "product": { "name": "Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el8" } } }, { "category": "product_name", "name": "Red Hat JBoss Web Server 6.1 for RHEL 9", "product": { "name": "Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el9" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server" }, { "branches": [ { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "product": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "product_id": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-7.redhat_00008.1.el10jws?arch=src" } } }, { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "product": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "product_id": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-7.redhat_00008.1.el8jws?arch=src" } } }, { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "product": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "product_id": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-7.redhat_00008.1.el9jws?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product": { "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_id": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.36-7.redhat_00008.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product": { "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_id": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.36-7.redhat_00008.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product": { "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_id": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.36-7.redhat_00008.1.el9jws?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src" }, "product_reference": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src" }, "product_reference": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src" }, "product_reference": "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-30T15:51:38+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11741" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-30T15:51:38+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11741" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-30T15:51:38+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11741" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-30T15:51:38+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11741" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-7.redhat_00008.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-7.redhat_00008.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14181
Vulnerability from csaf_redhat
Published
2025-08-20 15:41
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14181", "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14181.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-09-26T06:41:17+00:00", "generator": { "date": "2025-09-26T06:41:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:14181", "initial_release_date": "2025-08-20T15:41:15+00:00", "revision_history": [ { "date": "2025-08-20T15:41:15+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:41:15+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-3.el9_6.3.src", "product": { "name": "tomcat-1:9.0.87-3.el9_6.3.src", "product_id": "tomcat-1:9.0.87-3.el9_6.3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-3.el9_6.3?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-3.el9_6.3.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src" }, "product_reference": "tomcat-1:9.0.87-3.el9_6.3.src", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:11742
Vulnerability from csaf_redhat
Published
2025-07-30 15:55
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update
Notes
Topic
Red Hat JBoss Web Server 6.1.1 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 6.1.1 serves as a replacement for Red Hat JBoss Web Server 6.1.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload [jws-6] (CVE-2025-48988)
* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-6] (CVE-2025-49125)
* tomcat: Apache Commons FileUpload DoS via part headers [jws-6] (CVE-2025-48976)
* jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Web Server 6.1.1 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 6.1.1 serves as a replacement for Red Hat JBoss Web Server 6.1.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload [jws-6] (CVE-2025-48988)\n* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-6] (CVE-2025-49125)\n* tomcat: Apache Commons FileUpload DoS via part headers [jws-6] (CVE-2025-48976)\n* jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:11742", "url": "https://access.redhat.com/errata/RHSA-2025:11742" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_1_release_notes/index", "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_1_release_notes/index" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11742.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update", "tracking": { "current_release_date": "2025-09-26T06:41:01+00:00", "generator": { "date": "2025-09-26T06:41:01+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:11742", "initial_release_date": "2025-07-30T15:55:40+00:00", "revision_history": [ { "date": "2025-07-30T15:55:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-07-30T15:55:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:01+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 6.1.1", "product": { "name": "Red Hat JBoss Web Server 6.1.1", "product_id": "Red Hat JBoss Web Server 6.1.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 6.1.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-30T15:55:40+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 6.1.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11742" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 6.1.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 6.1.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 6.1.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-30T15:55:40+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 6.1.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11742" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 6.1.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 6.1.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 6.1.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-30T15:55:40+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 6.1.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11742" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 6.1.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 6.1.1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 6.1.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-30T15:55:40+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 6.1.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11742" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 6.1.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 6.1.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:11696
Vulnerability from csaf_redhat
Published
2025-07-28 13:56
Modified
2025-09-26 06:41
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update
Notes
Topic
Red Hat JBoss Web Server 5.8.5 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.8.5 serves as a replacement for Red Hat JBoss Web Server 5.8.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload [jws-5] (CVE-2025-48988)
* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-5] (CVE-2025-49125)
* tomcat: Apache Commons FileUpload DoS via part headers [jws-5] (CVE-2025-48976)
* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52520)
* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52434)
* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Web Server 5.8.5 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.8.5 serves as a replacement for Red Hat JBoss Web Server 5.8.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload [jws-5] (CVE-2025-48988)\n* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-5] (CVE-2025-49125)\n* tomcat: Apache Commons FileUpload DoS via part headers [jws-5] (CVE-2025-48976)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52520)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52434)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:11696", "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index", "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11696.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update", "tracking": { "current_release_date": "2025-09-26T06:41:00+00:00", "generator": { "date": "2025-09-26T06:41:00+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2025:11696", "initial_release_date": "2025-07-28T13:56:27+00:00", "revision_history": [ { "date": "2025-07-28T13:56:27+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-07-28T13:56:27+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T06:41:00+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 5.8.5", "product": { "name": "Red Hat JBoss Web Server 5.8.5", "product_id": "Red Hat JBoss Web Server 5.8.5", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 5.8.5" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:56:27+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 5.8.5" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:56:27+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 5.8.5" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:56:27+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 5.8.5" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:56:27+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11696" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 5.8.5" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:56:27+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 5.8.5" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-07-28T13:56:27+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 5.8.5" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
cve-2025-48976
Vulnerability from jvndb
Published
2025-06-26 14:41
Modified
2025-06-26 14:41
Severity ?
Summary
Denial-of-service (DoS) vulnerabilities in multiple Apache products
Details
Multiple Apache products provided by The Apache Software Foundation contain vulnerabilities listed below.
<ul><li>Allocation of resources without limits or throttling (CWE-770) - CVE-2025-48976, CVE-2025-48988</li></ul>
TERASOLUNA Framework Security Team of NTT DATA Group Corporation reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000044.html", "dc:date": "2025-06-26T14:41+09:00", "dcterms:issued": "2025-06-26T14:41+09:00", "dcterms:modified": "2025-06-26T14:41+09:00", "description": "Multiple Apache products provided by The Apache Software Foundation contain vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eAllocation of resources without limits or throttling (CWE-770) - CVE-2025-48976, CVE-2025-48988\u003c/li\u003e\u003c/ul\u003e\r\nTERASOLUNA Framework Security Team of NTT DATA Group Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.", "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000044.html", "sec:cpe": [ { "#text": "cpe:/a:apache:commons_fileupload", "@product": "Commons FileUpload", "@vendor": "Apache Software Foundation", "@version": "2.2" }, { "#text": "cpe:/a:apache:tomcat", "@product": "Apache Tomcat", "@vendor": "Apache Software Foundation", "@version": "2.2" } ], "sec:cvss": { "@score": "5.3", "@severity": "Medium", "@type": "Base", "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "@version": "3.0" }, "sec:identifier": "JVNDB-2025-000044", "sec:references": [ { "#text": "https://jvn.jp/en/jp/JVN09924566/index.html", "@id": "JVN#09924566", "@source": "JVN" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "@id": "CVE-2025-48976", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "@id": "CVE-2025-48988", "@source": "CVE" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-Other", "@title": "No Mapping(CWE-Other)" } ], "title": "Denial-of-service (DoS) vulnerabilities in multiple Apache products" }
ncsc-2025-0195
Vulnerability from csaf_ncscnl
Published
2025-06-18 08:01
Modified
2025-06-18 08:01
Summary
Kwetsbaarheden verholpen in Apache Tomcat
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Apache heeft kwetsbaarheden verholpen in Apache Tomcat (Specifiek voor versies 11.0.0-M1 tot 11.0.7, 10.1.0-M1 tot 10.1.41, en 9.0.0-M1 tot 9.0.105).
Interpretaties
De kwetsbaarheden omvatten een denial-of-service door onvoldoende limieten op multipart headers, een gebrek aan resource allocatie zonder limieten, een onbetrouwbaar zoekpad in de Windows installer, en een kritieke authenticatie omzeiling door onjuiste padverwerking. Aanvallers kunnen deze kwetsbaarheden misbruiken door speciaal samengestelde verzoeken te sturen, wat kan leiden tot ongeoorloofde toegang tot gevoelige bestanden en geheugenuitputting, met als gevolg een verstoring van de service.
Oplossingen
Apache heeft updates uitgebracht om de kwetsbaarheden te verhelpen, waaronder upgrades naar versies 11.0.8, 10.1.42, of 9.0.106. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-426
Untrusted Search Path
CWE-404
Improper Resource Shutdown or Release
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-288
Authentication Bypass Using an Alternate Path or Channel
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Apache heeft kwetsbaarheden verholpen in Apache Tomcat (Specifiek voor versies 11.0.0-M1 tot 11.0.7, 10.1.0-M1 tot 10.1.41, en 9.0.0-M1 tot 9.0.105).", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden omvatten een denial-of-service door onvoldoende limieten op multipart headers, een gebrek aan resource allocatie zonder limieten, een onbetrouwbaar zoekpad in de Windows installer, en een kritieke authenticatie omzeiling door onjuiste padverwerking. Aanvallers kunnen deze kwetsbaarheden misbruiken door speciaal samengestelde verzoeken te sturen, wat kan leiden tot ongeoorloofde toegang tot gevoelige bestanden en geheugenuitputting, met als gevolg een verstoring van de service.", "title": "Interpretaties" }, { "category": "description", "text": "Apache heeft updates uitgebracht om de kwetsbaarheden te verhelpen, waaronder upgrades naar versies 11.0.8, 10.1.42, of 9.0.106. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Untrusted Search Path", "title": "CWE-426" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Authentication Bypass Using an Alternate Path or Channel", "title": "CWE-288" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference - certbundde; github; ibm", "url": "https://tomcat.apache.org/security-10.html" }, { "category": "external", "summary": "Reference - certbundde; github", "url": "https://tomcat.apache.org/security-11.html" }, { "category": "external", "summary": "Reference - certbundde; cisagov; github", "url": "https://tomcat.apache.org/security-9.html" } ], "title": "Kwetsbaarheden verholpen in Apache Tomcat", "tracking": { "current_release_date": "2025-06-18T08:01:06.984131Z", "generator": { "date": "2025-06-05T14:45:00Z", "engine": { "name": "V.A.", "version": "1.1" } }, "id": "NCSC-2025-0195", "initial_release_date": "2025-06-18T08:01:06.984131Z", "revision_history": [ { "date": "2025-06-18T08:01:06.984131Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/10.1.0-m1|\u003c=10.1.41", "product": { "name": "vers:semver/10.1.0-m1|\u003c=10.1.41", "product_id": "CSAFPID-2919030" } }, { "category": "product_version_range", "name": "vers:semver/11.0.0-m1|\u003c=11.0.7", "product": { "name": "vers:semver/11.0.0-m1|\u003c=11.0.7", "product_id": "CSAFPID-2919017" } }, { "category": "product_version_range", "name": "vers:semver/9.0.0.m1|\u003c=9.0.105", "product": { "name": "vers:semver/9.0.0.m1|\u003c=9.0.105", "product_id": "CSAFPID-2919031" } } ], "category": "product_name", "name": "Apache Tomcat" } ], "category": "vendor", "name": "Apache Software Foundation" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2919030", "CSAFPID-2919017", "CSAFPID-2919031" ] }, "references": [ { "category": "self", "summary": "CVE-2025-48976 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48976.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-2919030", "CSAFPID-2919017", "CSAFPID-2919031" ] } ], "title": "CVE-2025-48976" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2919030", "CSAFPID-2919017", "CSAFPID-2919031" ] }, "references": [ { "category": "self", "summary": "CVE-2025-48988 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48988.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-2919030", "CSAFPID-2919017", "CSAFPID-2919031" ] } ], "title": "CVE-2025-48988" }, { "cve": "CVE-2025-49124", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "notes": [ { "category": "other", "text": "Untrusted Search Path", "title": "CWE-426" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2919030", "CSAFPID-2919017", "CSAFPID-2919031" ] }, "references": [ { "category": "self", "summary": "CVE-2025-49124 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-49124.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-2919030", "CSAFPID-2919017", "CSAFPID-2919031" ] } ], "title": "CVE-2025-49124" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "notes": [ { "category": "other", "text": "Authentication Bypass Using an Alternate Path or Channel", "title": "CWE-288" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2919030", "CSAFPID-2919017", "CSAFPID-2919031" ] }, "references": [ { "category": "self", "summary": "CVE-2025-49125 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-49125.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-2919030", "CSAFPID-2919017", "CSAFPID-2919031" ] } ], "title": "CVE-2025-49125" } ] }
ncsc-2025-0274
Vulnerability from csaf_ncscnl
Published
2025-09-09 11:06
Modified
2025-09-09 11:06
Summary
Kwetsbaarheden verholpen in Siemens producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Siemens heeft kwetsbaarheden verholpen in diverse producten als Apogee, Industial Edge, RUGGEDCOM, SIMATIC, SIMOTION en SINAMICS.
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Manipulatie van gegevens
- Omzeilen van een beveiligingsmaatregel
- (Remote) code execution (root/admin rechten)
- Toegang tot systeemgegevens
- Toegang tot gevoelige gegevens
- Verhogen van rechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-121
Stack-based Buffer Overflow
CWE-125
Out-of-bounds Read
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-269
Improper Privilege Management
CWE-400
Uncontrolled Resource Consumption
CWE-404
Improper Resource Shutdown or Release
CWE-732
Incorrect Permission Assignment for Critical Resource
CWE-754
Improper Check for Unusual or Exceptional Conditions
CWE-770
Allocation of Resources Without Limits or Throttling
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Siemens heeft kwetsbaarheden verholpen in diverse producten als Apogee, Industial Edge, RUGGEDCOM, SIMATIC, SIMOTION en SINAMICS.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Manipulatie van gegevens\n- Omzeilen van een beveiligingsmaatregel\n- (Remote) code execution (root/admin rechten)\n- Toegang tot systeemgegevens\n- Toegang tot gevoelige gegevens\n- Verhogen van rechten\n\nDe kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.", "title": "Interpretaties" }, { "category": "description", "text": "Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico\u0027s zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Improper Privilege Management", "title": "CWE-269" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" }, { "category": "general", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-027652.pdf" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-494539.pdf" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-534283.pdf" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-563922.pdf" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-640476.pdf" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-722410.pdf" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-916339.pdf" } ], "title": "Kwetsbaarheden verholpen in Siemens producten", "tracking": { "current_release_date": "2025-09-09T11:06:34.785987Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.2" } }, "id": "NCSC-2025-0274", "initial_release_date": "2025-09-09T11:06:34.785987Z", "revision_history": [ { "date": "2025-09-09T11:06:34.785987Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "APOGEE PXC Series (BACnet)" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "APOGEE PXC Series (P2 Ethernet)" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-3" } } ], "category": "product_name", "name": "RUGGEDCOM RST2428P" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-4" } } ], "category": "product_name", "name": "SIMATIC PCS neo V4.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-5" } } ], "category": "product_name", "name": "SIMATIC PCS neo V5.0" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-6" } } ], "category": "product_name", "name": "SIMATIC Virtualization as a Service (SIVaaS)" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-7" } } ], "category": "product_name", "name": "SINAMICS G220 V6.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-8" } } ], "category": "product_name", "name": "SINAMICS S200 V6.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-9" } } ], "category": "product_name", "name": "SINAMICS S210 V6.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-10" } } ], "category": "product_name", "name": "TALON TC Series (BACnet)" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-11" } } ], "category": "product_name", "name": "User Management Component (UMC)" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-40594", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "notes": [ { "category": "other", "text": "Improper Privilege Management", "title": "CWE-269" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40594 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40594.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40594" }, { "cve": "CVE-2025-40757", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40757 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40757.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40757" }, { "cve": "CVE-2025-40795", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40795 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40795.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40795" }, { "cve": "CVE-2025-40796", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40796 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40796.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40796" }, { "cve": "CVE-2025-40797", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40797 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40797.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40797" }, { "cve": "CVE-2025-40798", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40798 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40798.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40798" }, { "cve": "CVE-2025-40802", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40802 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40802.json" } ], "scores": [ { "cvss_v3": { "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40802" }, { "cve": "CVE-2025-40803", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40803 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40803.json" } ], "scores": [ { "cvss_v3": { "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40803" }, { "cve": "CVE-2025-40804", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40804 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40804.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-40804" }, { "cve": "CVE-2025-43715", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "other", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-43715 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43715.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-43715" }, { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] }, "references": [ { "category": "self", "summary": "CVE-2025-48976 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48976.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11" ] } ], "title": "CVE-2025-48976" } ] }
ghsa-vv7r-c36w-3prj
Vulnerability from github
Published
2025-06-16 15:32
Modified
2025-07-09 18:15
Severity ?
VLAI Severity ?
Summary
Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
Details
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "commons-fileupload:commons-fileupload" }, "ranges": [ { "events": [ { "introduced": "1.0" }, { "fixed": "1.6.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.apache.commons:commons-fileupload2-core" }, "ranges": [ { "events": [ { "introduced": "2.0.0-M1" }, { "fixed": "2.0.0-M4" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2025-48976" ], "database_specific": { "cwe_ids": [ "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2025-06-16T16:52:30Z", "nvd_published_at": "2025-06-16T15:15:24Z", "severity": "HIGH" }, "details": "Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.", "id": "GHSA-vv7r-c36w-3prj", "modified": "2025-07-09T18:15:38Z", "published": "2025-06-16T15:32:28Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "type": "WEB", "url": "https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b" }, { "type": "WEB", "url": "https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93" }, { "type": "PACKAGE", "url": "https://github.com/apache/commons-fileupload" }, { "type": "WEB", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/06/16/4" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers" }
fkie_cve-2025-48976
Vulnerability from fkie_nvd
Published
2025-06-16 15:15
Modified
2025-07-15 14:21
Severity ?
Summary
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
References
▼ | URL | Tags | |
---|---|---|---|
security@apache.org | https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12 | Mailing List, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2025/06/16/4 | Mailing List, Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
apache | commons_fileupload | * | |
apache | commons_fileupload | 2.0.0 | |
apache | commons_fileupload | 2.0.0 | |
apache | commons_fileupload | 2.0.0 | |
apache | commons_fileupload | 2.0.0 | |
apache | commons_fileupload | 2.0.0 | |
apache | commons_fileupload | 2.0.0 |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*", "matchCriteriaId": "20D93D43-A57F-4C1E-82AC-EB50648742EE", "versionEndExcluding": "1.6", "versionStartIncluding": "1.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:commons_fileupload:2.0.0:m1:*:*:*:*:*:*", "matchCriteriaId": "3B415BCF-AACF-4882-8882-10D99610C79D", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:commons_fileupload:2.0.0:m1-rc1:*:*:*:*:*:*", "matchCriteriaId": "EB892667-4AF8-41C6-9F40-D800CA16A8C6", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:commons_fileupload:2.0.0:m2:*:*:*:*:*:*", "matchCriteriaId": "9AE1594A-1C38-461E-B949-76A0C24A3C7F", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:commons_fileupload:2.0.0:m2-rc1:*:*:*:*:*:*", "matchCriteriaId": "827AA598-1A62-4529-A7C7-37EB9D56BE6A", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:commons_fileupload:2.0.0:m3:*:*:*:*:*:*", "matchCriteriaId": "AA5C9AC9-56E6-4864-9965-827C93755F8B", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:commons_fileupload:2.0.0:m3-rc1:*:*:*:*:*:*", "matchCriteriaId": "C2395D9D-DEF6-4CC7-87F9-6D8FC9DCEE74", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue." }, { "lang": "es", "value": "La asignaci\u00f3n de recursos para encabezados multiparte con l\u00edmites insuficientes gener\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en Apache Commons FileUpload. Este problema afecta a Apache Commons FileUpload: de la versi\u00f3n 1.0 a la 1.6; de la versi\u00f3n 2.0.0-M1 a la 2.0.0-M4. Se recomienda actualizar a las versiones 1.6 o 2.0.0-M4, que solucionan el problema." } ], "id": "CVE-2025-48976", "lastModified": "2025-07-15T14:21:41.997", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] }, "published": "2025-06-16T15:15:24.460", "references": [ { "source": "security@apache.org", "tags": [ "Mailing List", "Vendor Advisory" ], "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2025/06/16/4" } ], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-770" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] }
opensuse-su-2025:15208-1
Vulnerability from csaf_opensuse
Published
2025-07-03 00:00
Modified
2025-07-03 00:00
Summary
apache-commons-fileupload-1.6.0-1.1 on GA media
Notes
Title of the patch
apache-commons-fileupload-1.6.0-1.1 on GA media
Description of the patch
These are all security issues fixed in the apache-commons-fileupload-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15208
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "apache-commons-fileupload-1.6.0-1.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the apache-commons-fileupload-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2025-15208", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15208-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2025-48976 page", "url": "https://www.suse.com/security/cve/CVE-2025-48976/" } ], "title": "apache-commons-fileupload-1.6.0-1.1 on GA media", "tracking": { "current_release_date": "2025-07-03T00:00:00Z", "generator": { "date": "2025-07-03T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2025:15208-1", "initial_release_date": "2025-07-03T00:00:00Z", "revision_history": [ { "date": "2025-07-03T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "apache-commons-fileupload-1.6.0-1.1.aarch64", "product": { "name": "apache-commons-fileupload-1.6.0-1.1.aarch64", "product_id": "apache-commons-fileupload-1.6.0-1.1.aarch64" } }, { "category": "product_version", "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64", "product": { "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64", "product_id": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "apache-commons-fileupload-1.6.0-1.1.ppc64le", "product": { "name": "apache-commons-fileupload-1.6.0-1.1.ppc64le", "product_id": "apache-commons-fileupload-1.6.0-1.1.ppc64le" } }, { "category": "product_version", "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le", "product": { "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le", "product_id": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "apache-commons-fileupload-1.6.0-1.1.s390x", "product": { "name": "apache-commons-fileupload-1.6.0-1.1.s390x", "product_id": "apache-commons-fileupload-1.6.0-1.1.s390x" } }, { "category": "product_version", "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x", "product": { "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x", "product_id": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "apache-commons-fileupload-1.6.0-1.1.x86_64", "product": { "name": "apache-commons-fileupload-1.6.0-1.1.x86_64", "product_id": "apache-commons-fileupload-1.6.0-1.1.x86_64" } }, { "category": "product_version", "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64", "product": { "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64", "product_id": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "apache-commons-fileupload-1.6.0-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.aarch64" }, "product_reference": "apache-commons-fileupload-1.6.0-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-fileupload-1.6.0-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.ppc64le" }, "product_reference": "apache-commons-fileupload-1.6.0-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-fileupload-1.6.0-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.s390x" }, "product_reference": "apache-commons-fileupload-1.6.0-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-fileupload-1.6.0-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.x86_64" }, "product_reference": "apache-commons-fileupload-1.6.0-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64" }, "product_reference": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le" }, "product_reference": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.s390x" }, "product_reference": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64" }, "product_reference": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2025-48976" } ], "notes": [ { "category": "general", "text": "Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.aarch64", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.ppc64le", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.s390x", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.x86_64", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.s390x", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2025-48976", "url": "https://www.suse.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "SUSE Bug 1244657 for CVE-2025-48976", "url": "https://bugzilla.suse.com/1244657" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.aarch64", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.ppc64le", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.s390x", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.x86_64", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.s390x", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.aarch64", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.ppc64le", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.s390x", "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.x86_64", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.s390x", "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2025-07-03T00:00:00Z", "details": "important" } ], "title": "CVE-2025-48976" } ] }
ssa-640476
Vulnerability from csaf_siemens
Published
2025-09-09 00:00
Modified
2025-09-09 00:00
Summary
SSA-640476: Denial of Service Vulnerability in Industrial Edge Management
Notes
Summary
Industrial Edge Management is affected by a vulnerability that could allow a remote attacker to cause a denial of service condition.
Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)", "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Industrial Edge Management is affected by a vulnerability that could allow a remote attacker to cause a denial of service condition.\n\nSiemens recommends specific countermeasures for products where fixes are not, or not yet available.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "productcert@siemens.com", "name": "Siemens ProductCERT", "namespace": "https://www.siemens.com" }, "references": [ { "category": "self", "summary": "SSA-640476: Denial of Service Vulnerability in Industrial Edge Management - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-640476.html" }, { "category": "self", "summary": "SSA-640476: Denial of Service Vulnerability in Industrial Edge Management - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-640476.json" } ], "title": "SSA-640476: Denial of Service Vulnerability in Industrial Edge Management", "tracking": { "current_release_date": "2025-09-09T00:00:00Z", "generator": { "engine": { "name": "Siemens ProductCERT CSAF Generator", "version": "1" } }, "id": "SSA-640476", "initial_release_date": "2025-09-09T00:00:00Z", "revision_history": [ { "date": "2025-09-09T00:00:00Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Industrial Edge Management OS (IEM-OS)", "product_id": "1" } } ], "category": "product_name", "name": "Industrial Edge Management OS (IEM-OS)" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "summary", "text": "Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.", "title": "Summary" } ], "product_status": { "known_affected": [ "1" ] }, "remediations": [ { "category": "mitigation", "details": "Limit access to trusted users and systems only", "product_ids": [ "1" ] }, { "category": "mitigation", "details": "Migrate to Industrial Edge Management Virtual (IEM-V)", "product_ids": [ "1" ] }, { "category": "no_fix_planned", "details": "Currently no fix is planned", "product_ids": [ "1" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "1" ] } ], "title": "CVE-2025-48976" } ] }
icsa-25-254-06
Vulnerability from csaf_cisa
Published
2025-09-09 00:00
Modified
2025-09-09 00:00
Summary
Siemens Industrial Edge Management
Notes
Summary
Industrial Edge Management is affected by a vulnerability that could allow a remote attacker to cause a denial of service condition.
Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This ICSA is a verbatim republication of Siemens ProductCERT SSA-640476 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
Critical infrastructure sectors
Energy
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{ "document": { "acknowledgments": [ { "organization": "Siemens", "summary": "reporting this vulnerability to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Industrial Edge Management is affected by a vulnerability that could allow a remote attacker to cause a denial of service condition.\n\nSiemens recommends specific countermeasures for products where fixes are not, or not yet available.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This ICSA is a verbatim republication of Siemens ProductCERT SSA-640476 from a direct conversion of the vendor\u0027s Common Security Advisory Framework (CSAF) advisory. This is republished to CISA\u0027s website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Energy", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-640476: Denial of Service Vulnerability in Industrial Edge Management - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-640476.json" }, { "category": "self", "summary": "SSA-640476: Denial of Service Vulnerability in Industrial Edge Management - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-640476.html" }, { "category": "self", "summary": "ICS Advisory ICSA-25-254-06 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-254-06.json" }, { "category": "self", "summary": "ICS Advisory ICSA-25-254-06 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-06" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens Industrial Edge Management", "tracking": { "current_release_date": "2025-09-09T00:00:00.000000Z", "generator": { "date": "2025-09-10T22:19:26.907284Z", "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-25-254-06", "initial_release_date": "2025-09-09T00:00:00.000000Z", "revision_history": [ { "date": "2025-09-09T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Industrial Edge Management OS (IEM-OS)", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "Industrial Edge Management OS (IEM-OS)" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "summary", "text": "Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Limit access to trusted users and systems only", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "Migrate to Industrial Edge Management Virtual (IEM-V)", "product_ids": [ "CSAFPID-0001" ] }, { "category": "no_fix_planned", "details": "Currently no fix is planned", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2025-48976" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…