Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-48989 (GCVE-0-2025-48989)
Vulnerability from cvelistv5
Published
2025-08-13 12:11
Modified
2025-08-13 19:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-404 - Improper Resource Shutdown or Release
Summary
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.
Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
References
▼ | URL | Tags | |
---|---|---|---|
security@apache.org | https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf | Mailing List, Vendor Advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Apache Software Foundation | Apache Tomcat |
Version: 11.0.0-M1 ≤ 11.0.9 Version: 10.1.0-M1 ≤ 10.1.43 Version: 9.0.0.M1 ≤ 9.0.107 |
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-48989", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-08-13T18:37:15.707400Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-08-13T19:56:35.999Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [ { "lessThanOrEqual": "11.0.9", "status": "affected", "version": "11.0.0-M1", "versionType": "semver" }, { "lessThanOrEqual": "10.1.43", "status": "affected", "version": "10.1.0-M1", "versionType": "semver" }, { "lessThanOrEqual": "9.0.107", "status": "affected", "version": "9.0.0.M1", "versionType": "semver" }, { "lessThanOrEqual": "8.5.100", "status": "unknown", "version": "8.5.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel of Tel Aviv University" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\u003c/p\u003e" } ], "value": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue." } ], "metrics": [ { "other": { "content": { "text": "important" }, "type": "Textual description of severity" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-08-13T12:11:26.124Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf" } ], "source": { "discovery": "EXTERNAL" }, "title": "Apache Tomcat: h2 DoS - Made You Reset", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2025-48989", "datePublished": "2025-08-13T12:11:26.124Z", "dateReserved": "2025-05-29T15:25:37.243Z", "dateUpdated": "2025-08-13T19:56:35.999Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2025-48989\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2025-08-13T13:15:34.153\",\"lastModified\":\"2025-08-18T18:34:04.980\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\\n\\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\\n\\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de apagado o liberaci\u00f3n incorrecta de recursos en Apache Tomcat lo hizo vulnerable al ataque \\\"Maked You Reset\\\". Este problema afecta a Apache Tomcat desde la versi\u00f3n 11.0.0-M1 hasta la 11.0.9, desde la 10.1.0-M1 hasta la 10.1.43 y desde la 9.0.0.M1 hasta la 9.0.107. Las versiones anteriores al final de su vida \u00fatil tambi\u00e9n pueden verse afectadas. Se recomienda actualizar a una de las versiones 11.0.10, 10.1.44 o 9.0.108, que solucionan el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-404\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.1\",\"versionEndExcluding\":\"9.0.108\",\"matchCriteriaId\":\"BB3FEF17-23FB-460F-AEF8-FDBA52DC2B3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.1.44\",\"matchCriteriaId\":\"0820A463-9915-448C-9EC0-49F79D12708A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.0.10\",\"matchCriteriaId\":\"CA7FF893-81BF-455F-A9D5-47D6A6F9E6E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D0689FE-4BC0-4F53-8C79-34B21F9B86C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*\",\"matchCriteriaId\":\"89B129B2-FB6F-4EF9-BF12-E589A87996CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B6787B6-54A8-475E-BA1C-AB99334B2535\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*\",\"matchCriteriaId\":\"EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*\",\"matchCriteriaId\":\"E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A6DA0BE-908C-4DA8-A191-A0113235E99A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*\",\"matchCriteriaId\":\"39029C72-28B4-46A4-BFF5-EC822CFB2A4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A2E05A3-014F-4C4D-81E5-88E725FBD6AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*\",\"matchCriteriaId\":\"166C533C-0833-41D5-99B6-17A4FAB3CAF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3768C60-21FA-4B92-B98C-C3A2602D1BC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F542E12-6BA8-4504-A494-DA83E7E19BD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2409CC7-6A85-4A66-A457-0D62B9895DC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*\",\"matchCriteriaId\":\"B392A7E5-4455-4B1C-8FAC-AE6DDC70689E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF411DDA-2601-449A-9046-D250419A0E1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7D8F2F4-AFE2-47EA-A3FD-79B54324DE02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B4FBF97-DE16-4E5E-BE19-471E01818D40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B266B1E-24B5-47EE-A421-E0E3CC0C7471\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*\",\"matchCriteriaId\":\"29614C3A-6FB3-41C7-B56E-9CC3F45B04F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6AB156C-8FF6-4727-AF75-590D0DCB3F9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0C5F004-F7D8-45DB-B173-351C50B0EC16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1902D2E-1896-4D3D-9E1C-3A675255072C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*\",\"matchCriteriaId\":\"49AAF4DF-F61D-47A8-8788-A21E317A145D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*\",\"matchCriteriaId\":\"454211D0-60A2-4661-AECA-4C0121413FEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*\",\"matchCriteriaId\":\"0686F977-889F-4960-8E0B-7784B73A7F2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*\",\"matchCriteriaId\":\"558703AE-DB5E-4DFF-B497-C36694DD7B24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED6273F2-1165-47A4-8DD7-9E9B2472941B\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}", "vulnrichment": { "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-48989\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-13T18:37:15.707400Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-13T18:37:19.170Z\"}}], \"cna\": {\"title\": \"Apache Tomcat: h2 DoS - Made You Reset\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel of Tel Aviv University\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Tomcat\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.0.0-M1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.0.9\"}, {\"status\": \"affected\", \"version\": \"10.1.0-M1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.1.43\"}, {\"status\": \"affected\", \"version\": \"9.0.0.M1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.0.107\"}, {\"status\": \"unknown\", \"version\": \"8.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.5.100\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\\n\\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\\n\\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-404\", \"description\": \"CWE-404 Improper Resource Shutdown or Release\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2025-08-13T12:11:26.124Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2025-48989\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-13T19:56:35.999Z\", \"dateReserved\": \"2025-05-29T15:25:37.243Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2025-08-13T12:11:26.124Z\", \"assignerShortName\": \"apache\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1" } } }
ghsa-gqp3-2cvr-x8m3
Vulnerability from github
Published
2025-08-13 15:30
Modified
2025-08-22 20:52
Severity ?
VLAI Severity ?
Summary
Apache Tomcat Improper Resource Shutdown or Release vulnerability
Details
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.
Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote" }, "ranges": [ { "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.10" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote" }, "ranges": [ { "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.44" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote" }, "ranges": [ { "events": [ { "introduced": "9.0.0.M1" }, { "fixed": "9.0.108" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.apache.tomcat.embed:tomcat-embed-core" }, "ranges": [ { "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.10" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.apache.tomcat.embed:tomcat-embed-core" }, "ranges": [ { "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.44" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.apache.tomcat.embed:tomcat-embed-core" }, "ranges": [ { "events": [ { "introduced": "9.0.0.M1" }, { "fixed": "9.0.108" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2025-48989" ], "database_specific": { "cwe_ids": [ "CWE-404" ], "github_reviewed": true, "github_reviewed_at": "2025-08-13T23:09:12Z", "nvd_published_at": "2025-08-13T13:15:34Z", "severity": "HIGH" }, "details": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.", "id": "GHSA-gqp3-2cvr-x8m3", "modified": "2025-08-22T20:52:22Z", "published": "2025-08-13T15:30:34Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/f36b8a4eea4ce8a0bc035079e1d259d29f5eb7bf" }, { "type": "PACKAGE", "url": "https://github.com/apache/tomcat" }, { "type": "WEB", "url": "https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-10.html" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-11.html" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-9.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Apache Tomcat Improper Resource Shutdown or Release vulnerability" }
rhsa-2025:14179
Vulnerability from csaf_redhat
Published
2025-08-20 15:36
Modified
2025-08-20 21:08
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14179", "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14179.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-08-20T21:08:29+00:00", "generator": { "date": "2025-08-20T21:08:29+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:14179", "initial_release_date": "2025-08-20T15:36:15+00:00", "revision_history": [ { "date": "2025-08-20T15:36:15+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:36:15+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:08:29+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10.0" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:10.1.36-1.el10_0.2.src", "product": { "name": "tomcat-1:10.1.36-1.el10_0.2.src", "product_id": "tomcat-1:10.1.36-1.el10_0.2.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@10.1.36-1.el10_0.2?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-5.0-api@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-3.1-api@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-6.0-api@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch", "product": { "name": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch", "product_id": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@10.1.36-1.el10_0.2?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:10.1.36-1.el10_0.2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src" }, "product_reference": "tomcat-1:10.1.36-1.el10_0.2.src", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" }, "product_reference": "tomcat-webapps-1:10.1.36-1.el10_0.2.noarch", "relates_to_product_reference": "AppStream-10.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.2.src", "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.2.noarch", "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.2.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14180
Vulnerability from csaf_redhat
Published
2025-08-20 15:43
Modified
2025-08-20 21:08
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14180", "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14180.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-08-20T21:08:55+00:00", "generator": { "date": "2025-08-20T21:08:55+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:14180", "initial_release_date": "2025-08-20T15:43:40+00:00", "revision_history": [ { "date": "2025-08-20T15:43:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:43:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:08:55+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el9_4.6.src", "product": { "name": "tomcat-1:9.0.87-1.el9_4.6.src", "product_id": "tomcat-1:9.0.87-1.el9_4.6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el9_4.6?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch", "product_id": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el9_4.6?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el9_4.6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src" }, "product_reference": "tomcat-1:9.0.87-1.el9_4.6.src", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)", "product_id": "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el9_4.6.noarch", "relates_to_product_reference": "AppStream-9.4.0.Z.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:43:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-1:9.0.87-1.el9_4.6.src", "AppStream-9.4.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-lib-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el9_4.6.noarch", "AppStream-9.4.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el9_4.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14178
Vulnerability from csaf_redhat
Published
2025-08-20 15:33
Modified
2025-08-20 21:09
Summary
Red Hat Security Advisory: tomcat9 security update
Notes
Topic
An update for tomcat9 is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat9 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14178", "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14178.json" } ], "title": "Red Hat Security Advisory: tomcat9 security update", "tracking": { "current_release_date": "2025-08-20T21:09:26+00:00", "generator": { "date": "2025-08-20T21:09:26+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:14178", "initial_release_date": "2025-08-20T15:33:55+00:00", "revision_history": [ { "date": "2025-08-20T15:33:55+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:33:55+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:09:26+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10.0" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat9-1:9.0.87-5.el10_0.3.src", "product": { "name": "tomcat9-1:9.0.87-5.el10_0.3.src", "product_id": "tomcat9-1:9.0.87-5.el10_0.3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9@9.0.87-5.el10_0.3?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat9-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-admin-webapps@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-docs-webapp@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-el-3.0-api@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-jsp-2.3-api@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-lib@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-servlet-4.0-api@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch", "product": { "name": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch", "product_id": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat9-webapps@9.0.87-5.el10_0.3?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat9-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-1:9.0.87-5.el10_0.3.src as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src" }, "product_reference": "tomcat9-1:9.0.87-5.el10_0.3.src", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" }, "product_reference": "tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch", "relates_to_product_reference": "AppStream-10.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:33:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-1:9.0.87-5.el10_0.3.src", "AppStream-10.0.Z:tomcat9-admin-webapps-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-docs-webapp-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-el-3.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-jsp-2.3-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-lib-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-servlet-4.0-api-1:9.0.87-5.el10_0.3.noarch", "AppStream-10.0.Z:tomcat9-webapps-1:9.0.87-5.el10_0.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14183
Vulnerability from csaf_redhat
Published
2025-08-20 15:40
Modified
2025-08-20 21:07
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14183", "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14183.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-08-20T21:07:48+00:00", "generator": { "date": "2025-08-20T21:07:48+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:14183", "initial_release_date": "2025-08-20T15:40:30+00:00", "revision_history": [ { "date": "2025-08-20T15:40:30+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:40:30+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:07:48+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el9_2.6.src", "product": { "name": "tomcat-1:9.0.87-1.el9_2.6.src", "product_id": "tomcat-1:9.0.87-1.el9_2.6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el9_2.6?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch", "product_id": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el9_2.6?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el9_2.6.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src" }, "product_reference": "tomcat-1:9.0.87-1.el9_2.6.src", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)", "product_id": "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el9_2.6.noarch", "relates_to_product_reference": "AppStream-9.2.0.Z.E4S" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:40:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.87-1.el9_2.6.src", "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el9_2.6.noarch", "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el9_2.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14182
Vulnerability from csaf_redhat
Published
2025-08-20 15:36
Modified
2025-08-20 21:06
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14182", "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14182.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-08-20T21:06:34+00:00", "generator": { "date": "2025-08-20T21:06:34+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:14182", "initial_release_date": "2025-08-20T15:36:45+00:00", "revision_history": [ { "date": "2025-08-20T15:36:45+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:36:45+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:06:34+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product": { "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el8_8.7.src", "product": { "name": "tomcat-1:9.0.87-1.el8_8.7.src", "product_id": "tomcat-1:9.0.87-1.el8_8.7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_8.7?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "product_id": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el8_8.7?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_8.7.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src" }, "product_reference": "tomcat-1:9.0.87-1.el8_8.7.src", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_8.7.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src" }, "product_reference": "tomcat-1:9.0.87-1.el8_8.7.src", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:36:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.E4S:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.E4S:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-1.el8_8.7.src", "AppStream-8.8.0.Z.TUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-lib-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.7.noarch", "AppStream-8.8.0.Z.TUS:tomcat-webapps-1:9.0.87-1.el8_8.7.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14177
Vulnerability from csaf_redhat
Published
2025-08-20 15:37
Modified
2025-08-20 21:09
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14177", "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14177.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-08-20T21:09:22+00:00", "generator": { "date": "2025-08-20T21:09:22+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:14177", "initial_release_date": "2025-08-20T15:37:48+00:00", "revision_history": [ { "date": "2025-08-20T15:37:48+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:37:48+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:09:22+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el8_10.6.src", "product": { "name": "tomcat-1:9.0.87-1.el8_10.6.src", "product_id": "tomcat-1:9.0.87-1.el8_10.6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_10.6?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch", "product_id": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el8_10.6?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-1.el8_10.6.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src" }, "product_reference": "tomcat-1:9.0.87-1.el8_10.6.src", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-1.el8_10.6.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:37:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-1:9.0.87-1.el8_10.6.src", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_10.6.noarch", "AppStream-8.10.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-1.el8_10.6.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:14181
Vulnerability from csaf_redhat
Published
2025-08-20 15:41
Modified
2025-08-20 21:09
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
* tomcat: Apache Tomcat denial of service (CVE-2025-52520)
* tomcat: Apache Tomcat denial of service (CVE-2025-52434)
* tomcat: Apache Tomcat denial of service (CVE-2025-53506)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tomcat is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:14181", "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14181.json" } ], "title": "Red Hat Security Advisory: tomcat security update", "tracking": { "current_release_date": "2025-08-20T21:09:32+00:00", "generator": { "date": "2025-08-20T21:09:32+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:14181", "initial_release_date": "2025-08-20T15:41:15+00:00", "revision_history": [ { "date": "2025-08-20T15:41:15+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-20T15:41:15+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:09:32+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-3.el9_6.3.src", "product": { "name": "tomcat-1:9.0.87-3.el9_6.3.src", "product_id": "tomcat-1:9.0.87-3.el9_6.3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-3.el9_6.3?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "tomcat-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch", "product": { "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch", "product_id": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.87-3.el9_6.3.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src" }, "product_reference": "tomcat-1:9.0.87-3.el9_6.3.src", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" }, "product_reference": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48976", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T16:00:46.319735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373020" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48976" }, { "category": "external", "summary": "RHBZ#2373020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976" }, { "category": "external", "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12", "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12" } ], "release_date": "2025-06-16T15:00:48.140000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers" }, { "cve": "CVE-2025-48988", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2025-06-16T15:00:56.878149+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373015" } ], "notes": [ { "category": "description", "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat DoS in multipart upload", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48988" }, { "category": "external", "summary": "RHBZ#2373015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, { "category": "external", "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18", "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18" } ], "release_date": "2025-06-16T14:13:40.457000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat DoS in multipart upload" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-49125", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2025-06-16T15:01:10.747453+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373018" } ], "notes": [ { "category": "description", "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-49125" }, { "category": "external", "summary": "RHBZ#2373018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, { "category": "external", "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk", "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" } ], "release_date": "2025-06-16T14:18:09.610000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources" }, { "cve": "CVE-2025-52434", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "discovery_date": "2025-07-10T20:01:51.277157+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379382" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52434" }, { "category": "external", "summary": "RHBZ#2379382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, { "category": "external", "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030", "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030" } ], "release_date": "2025-07-10T19:03:47.225000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" }, { "cve": "CVE-2025-53506", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-07-10T20:02:08.548439+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379386" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-53506" }, { "category": "external", "summary": "RHBZ#2379386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "category": "external", "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" } ], "release_date": "2025-07-10T19:14:23.249000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-20T15:41:15+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch", "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:13685
Vulnerability from csaf_redhat
Published
2025-08-13 15:06
Modified
2025-08-20 21:07
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.2 release and security update
Notes
Topic
Red Hat JBoss Web Server 6.1.2 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 6.1.2 serves as a replacement for Red Hat JBoss Web Server 6.1.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-52520)
* [Minor Incident] tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames [jws-6] (CVE-2025-48989)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Web Server 6.1.2 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 6.1.2 serves as a replacement for Red Hat JBoss Web Server 6.1.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-52520)\n* [Minor Incident] tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames [jws-6] (CVE-2025-48989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:13685", "url": "https://access.redhat.com/errata/RHSA-2025:13685" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_2_release_notes/index", "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_2_release_notes/index" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13685.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.2 release and security update", "tracking": { "current_release_date": "2025-08-20T21:07:18+00:00", "generator": { "date": "2025-08-20T21:07:18+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:13685", "initial_release_date": "2025-08-13T15:06:51+00:00", "revision_history": [ { "date": "2025-08-13T15:06:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-13T15:06:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:07:18+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 6.1 for RHEL 10", "product": { "name": "Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el10" } } }, { "category": "product_name", "name": "Red Hat JBoss Web Server 6.1 for RHEL 8", "product": { "name": "Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el8" } } }, { "category": "product_name", "name": "Red Hat JBoss Web Server 6.1 for RHEL 9", "product": { "name": "Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el9" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server" }, { "branches": [ { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "product": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "product_id": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-8.redhat_00009.1.el10jws?arch=src" } } }, { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "product": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "product_id": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-8.redhat_00009.1.el8jws?arch=src" } } }, { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "product": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "product_id": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-8.redhat_00009.1.el9jws?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product": { "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_id": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.36-8.redhat_00009.1.el10jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product": { "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_id": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.36-8.redhat_00009.1.el8jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } }, { "category": "product_version", "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product": { "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_id": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.36-8.redhat_00009.1.el9jws?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src" }, "product_reference": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 10", "product_id": "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch" }, "product_reference": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "relates_to_product_reference": "10Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src" }, "product_reference": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 8", "product_id": "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch" }, "product_reference": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "relates_to_product_reference": "8Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src" }, "product_reference": "jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" }, { "category": "default_component_of", "full_product_name": { "name": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.1 for RHEL 9", "product_id": "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" }, "product_reference": "jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "relates_to_product_reference": "9Base-JWS-6.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-13T15:06:51+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:13685" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-13T15:06:51+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:13685" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el10jws.src", "10Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "10Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el10jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el8jws.src", "8Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "8Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el8jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-0:10.1.36-8.redhat_00009.1.el9jws.src", "9Base-JWS-6.1:jws6-tomcat-admin-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-docs-webapp-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-el-5.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-javadoc-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-jsp-3.1-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-lib-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-selinux-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-servlet-6.0-api-0:10.1.36-8.redhat_00009.1.el9jws.noarch", "9Base-JWS-6.1:jws6-tomcat-webapps-0:10.1.36-8.redhat_00009.1.el9jws.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
rhsa-2025:13686
Vulnerability from csaf_redhat
Published
2025-08-13 15:04
Modified
2025-08-20 21:07
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.2 release and security update
Notes
Topic
Red Hat JBoss Web Server 6.1.2 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 6.1.2 serves as a replacement for Red Hat JBoss Web Server 6.1.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-52520)
* [Minor Incident] tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames [jws-6] (CVE-2025-48989)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Web Server 6.1.2 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 6.1.2 serves as a replacement for Red Hat JBoss Web Server 6.1.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-52520)\n* [Minor Incident] tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames [jws-6] (CVE-2025-48989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2025:13686", "url": "https://access.redhat.com/errata/RHSA-2025:13686" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_2_release_notes/index", "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_2_release_notes/index" }, { "category": "external", "summary": "2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13686.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.2 release and security update", "tracking": { "current_release_date": "2025-08-20T21:07:07+00:00", "generator": { "date": "2025-08-20T21:07:07+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.6" } }, "id": "RHSA-2025:13686", "initial_release_date": "2025-08-13T15:04:27+00:00", "revision_history": [ { "date": "2025-08-13T15:04:27+00:00", "number": "1", "summary": "Initial version" }, { "date": "2025-08-13T15:04:27+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-08-20T21:07:07+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 6.1.2", "product": { "name": "Red Hat JBoss Web Server 6.1.2", "product_id": "Red Hat JBoss Web Server 6.1.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2025-06-18T08:15:11.266000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2373309" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 6.1.2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "RHBZ#2373309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/767506", "url": "https://kb.cert.org/vuls/id/767506" } ], "release_date": "2025-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-13T15:04:27+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 6.1.2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:13686" }, { "category": "workaround", "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.", "product_ids": [ "Red Hat JBoss Web Server 6.1.2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 6.1.2" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames" }, { "cve": "CVE-2025-52520", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2025-07-10T20:01:27.937417+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2379374" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 6.1.2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-52520" }, { "category": "external", "summary": "RHBZ#2379374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, { "category": "external", "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5", "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5" } ], "release_date": "2025-07-10T19:05:41.637000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2025-08-13T15:04:27+00:00", "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.", "product_ids": [ "Red Hat JBoss Web Server 6.1.2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2025:13686" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat JBoss Web Server 6.1.2" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red Hat JBoss Web Server 6.1.2" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Apache Tomcat denial of service" } ] }
opensuse-su-2025:15489-1
Vulnerability from csaf_opensuse
Published
2025-08-25 00:00
Modified
2025-08-25 00:00
Summary
tomcat-9.0.108-1.1 on GA media
Notes
Title of the patch
tomcat-9.0.108-1.1 on GA media
Description of the patch
These are all security issues fixed in the tomcat-9.0.108-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15489
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "tomcat-9.0.108-1.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the tomcat-9.0.108-1.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2025-15489", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15489-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2025-48989 page", "url": "https://www.suse.com/security/cve/CVE-2025-48989/" } ], "title": "tomcat-9.0.108-1.1 on GA media", "tracking": { "current_release_date": "2025-08-25T00:00:00Z", "generator": { "date": "2025-08-25T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2025:15489-1", "initial_release_date": "2025-08-25T00:00:00Z", "revision_history": [ { "date": "2025-08-25T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "tomcat-9.0.108-1.1.aarch64", "product": { "name": "tomcat-9.0.108-1.1.aarch64", "product_id": "tomcat-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-admin-webapps-9.0.108-1.1.aarch64", "product": { "name": "tomcat-admin-webapps-9.0.108-1.1.aarch64", "product_id": "tomcat-admin-webapps-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-docs-webapp-9.0.108-1.1.aarch64", "product": { "name": "tomcat-docs-webapp-9.0.108-1.1.aarch64", "product_id": "tomcat-docs-webapp-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-el-3_0-api-9.0.108-1.1.aarch64", "product": { "name": "tomcat-el-3_0-api-9.0.108-1.1.aarch64", "product_id": "tomcat-el-3_0-api-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-embed-9.0.108-1.1.aarch64", "product": { "name": "tomcat-embed-9.0.108-1.1.aarch64", "product_id": "tomcat-embed-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-javadoc-9.0.108-1.1.aarch64", "product": { "name": "tomcat-javadoc-9.0.108-1.1.aarch64", "product_id": "tomcat-javadoc-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-jsp-2_3-api-9.0.108-1.1.aarch64", "product": { "name": "tomcat-jsp-2_3-api-9.0.108-1.1.aarch64", "product_id": "tomcat-jsp-2_3-api-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-jsvc-9.0.108-1.1.aarch64", "product": { "name": "tomcat-jsvc-9.0.108-1.1.aarch64", "product_id": "tomcat-jsvc-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-lib-9.0.108-1.1.aarch64", "product": { "name": "tomcat-lib-9.0.108-1.1.aarch64", "product_id": "tomcat-lib-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-servlet-4_0-api-9.0.108-1.1.aarch64", "product": { "name": "tomcat-servlet-4_0-api-9.0.108-1.1.aarch64", "product_id": "tomcat-servlet-4_0-api-9.0.108-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat-webapps-9.0.108-1.1.aarch64", "product": { "name": "tomcat-webapps-9.0.108-1.1.aarch64", "product_id": "tomcat-webapps-9.0.108-1.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "tomcat-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-9.0.108-1.1.ppc64le", "product_id": "tomcat-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-admin-webapps-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-admin-webapps-9.0.108-1.1.ppc64le", "product_id": "tomcat-admin-webapps-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-docs-webapp-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-docs-webapp-9.0.108-1.1.ppc64le", "product_id": "tomcat-docs-webapp-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-el-3_0-api-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-el-3_0-api-9.0.108-1.1.ppc64le", "product_id": "tomcat-el-3_0-api-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-embed-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-embed-9.0.108-1.1.ppc64le", "product_id": "tomcat-embed-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-javadoc-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-javadoc-9.0.108-1.1.ppc64le", "product_id": "tomcat-javadoc-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le", "product_id": "tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-jsvc-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-jsvc-9.0.108-1.1.ppc64le", "product_id": "tomcat-jsvc-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-lib-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-lib-9.0.108-1.1.ppc64le", "product_id": "tomcat-lib-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le", "product_id": "tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat-webapps-9.0.108-1.1.ppc64le", "product": { "name": "tomcat-webapps-9.0.108-1.1.ppc64le", "product_id": "tomcat-webapps-9.0.108-1.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "tomcat-9.0.108-1.1.s390x", "product": { "name": "tomcat-9.0.108-1.1.s390x", "product_id": "tomcat-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-admin-webapps-9.0.108-1.1.s390x", "product": { "name": "tomcat-admin-webapps-9.0.108-1.1.s390x", "product_id": "tomcat-admin-webapps-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-docs-webapp-9.0.108-1.1.s390x", "product": { "name": "tomcat-docs-webapp-9.0.108-1.1.s390x", "product_id": "tomcat-docs-webapp-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-el-3_0-api-9.0.108-1.1.s390x", "product": { "name": "tomcat-el-3_0-api-9.0.108-1.1.s390x", "product_id": "tomcat-el-3_0-api-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-embed-9.0.108-1.1.s390x", "product": { "name": "tomcat-embed-9.0.108-1.1.s390x", "product_id": "tomcat-embed-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-javadoc-9.0.108-1.1.s390x", "product": { "name": "tomcat-javadoc-9.0.108-1.1.s390x", "product_id": "tomcat-javadoc-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-jsp-2_3-api-9.0.108-1.1.s390x", "product": { "name": "tomcat-jsp-2_3-api-9.0.108-1.1.s390x", "product_id": "tomcat-jsp-2_3-api-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-jsvc-9.0.108-1.1.s390x", "product": { "name": "tomcat-jsvc-9.0.108-1.1.s390x", "product_id": "tomcat-jsvc-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-lib-9.0.108-1.1.s390x", "product": { "name": "tomcat-lib-9.0.108-1.1.s390x", "product_id": "tomcat-lib-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-servlet-4_0-api-9.0.108-1.1.s390x", "product": { "name": "tomcat-servlet-4_0-api-9.0.108-1.1.s390x", "product_id": "tomcat-servlet-4_0-api-9.0.108-1.1.s390x" } }, { "category": "product_version", "name": "tomcat-webapps-9.0.108-1.1.s390x", "product": { "name": "tomcat-webapps-9.0.108-1.1.s390x", "product_id": "tomcat-webapps-9.0.108-1.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "tomcat-9.0.108-1.1.x86_64", "product": { "name": "tomcat-9.0.108-1.1.x86_64", "product_id": "tomcat-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-admin-webapps-9.0.108-1.1.x86_64", "product": { "name": "tomcat-admin-webapps-9.0.108-1.1.x86_64", "product_id": "tomcat-admin-webapps-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-docs-webapp-9.0.108-1.1.x86_64", "product": { "name": "tomcat-docs-webapp-9.0.108-1.1.x86_64", "product_id": "tomcat-docs-webapp-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-el-3_0-api-9.0.108-1.1.x86_64", "product": { "name": "tomcat-el-3_0-api-9.0.108-1.1.x86_64", "product_id": "tomcat-el-3_0-api-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-embed-9.0.108-1.1.x86_64", "product": { "name": "tomcat-embed-9.0.108-1.1.x86_64", "product_id": "tomcat-embed-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-javadoc-9.0.108-1.1.x86_64", "product": { "name": "tomcat-javadoc-9.0.108-1.1.x86_64", "product_id": "tomcat-javadoc-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-jsp-2_3-api-9.0.108-1.1.x86_64", "product": { "name": "tomcat-jsp-2_3-api-9.0.108-1.1.x86_64", "product_id": "tomcat-jsp-2_3-api-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-jsvc-9.0.108-1.1.x86_64", "product": { "name": "tomcat-jsvc-9.0.108-1.1.x86_64", "product_id": "tomcat-jsvc-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-lib-9.0.108-1.1.x86_64", "product": { "name": "tomcat-lib-9.0.108-1.1.x86_64", "product_id": "tomcat-lib-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-servlet-4_0-api-9.0.108-1.1.x86_64", "product": { "name": "tomcat-servlet-4_0-api-9.0.108-1.1.x86_64", "product_id": "tomcat-servlet-4_0-api-9.0.108-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat-webapps-9.0.108-1.1.x86_64", "product": { "name": "tomcat-webapps-9.0.108-1.1.x86_64", "product_id": "tomcat-webapps-9.0.108-1.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-9.0.108-1.1.s390x" }, "product_reference": "tomcat-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-admin-webapps-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-admin-webapps-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.s390x" }, "product_reference": "tomcat-admin-webapps-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-admin-webapps-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-docs-webapp-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-docs-webapp-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.s390x" }, "product_reference": "tomcat-docs-webapp-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-docs-webapp-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3_0-api-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-el-3_0-api-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3_0-api-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-el-3_0-api-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3_0-api-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.s390x" }, "product_reference": "tomcat-el-3_0-api-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3_0-api-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-el-3_0-api-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-embed-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-embed-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-embed-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-embed-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-embed-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.s390x" }, "product_reference": "tomcat-embed-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-embed-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-embed-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-javadoc-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-javadoc-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-javadoc-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-javadoc-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-javadoc-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.s390x" }, "product_reference": "tomcat-javadoc-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-javadoc-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-javadoc-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2_3-api-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-jsp-2_3-api-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2_3-api-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.s390x" }, "product_reference": "tomcat-jsp-2_3-api-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2_3-api-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-jsp-2_3-api-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsvc-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-jsvc-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsvc-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-jsvc-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsvc-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.s390x" }, "product_reference": "tomcat-jsvc-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsvc-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-jsvc-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-lib-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-lib-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.s390x" }, "product_reference": "tomcat-lib-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-lib-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4_0-api-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-servlet-4_0-api-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4_0-api-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.s390x" }, "product_reference": "tomcat-servlet-4_0-api-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4_0-api-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-servlet-4_0-api-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-9.0.108-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.aarch64" }, "product_reference": "tomcat-webapps-9.0.108-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-9.0.108-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.ppc64le" }, "product_reference": "tomcat-webapps-9.0.108-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-9.0.108-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.s390x" }, "product_reference": "tomcat-webapps-9.0.108-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-9.0.108-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.x86_64" }, "product_reference": "tomcat-webapps-9.0.108-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48989", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2025-48989" } ], "notes": [ { "category": "general", "text": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:tomcat-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2025-48989", "url": "https://www.suse.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "SUSE Bug 1243888 for CVE-2025-48989", "url": "https://bugzilla.suse.com/1243888" }, { "category": "external", "summary": "SUSE Bug 1243895 for CVE-2025-48989", "url": "https://bugzilla.suse.com/1243895" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:tomcat-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:tomcat-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.108-1.1.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.108-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2025-08-25T00:00:00Z", "details": "important" } ], "title": "CVE-2025-48989" } ] }
opensuse-su-2025:15490-1
Vulnerability from csaf_opensuse
Published
2025-08-25 00:00
Modified
2025-08-25 00:00
Summary
tomcat10-10.1.44-1.1 on GA media
Notes
Title of the patch
tomcat10-10.1.44-1.1 on GA media
Description of the patch
These are all security issues fixed in the tomcat10-10.1.44-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15490
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "tomcat10-10.1.44-1.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the tomcat10-10.1.44-1.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2025-15490", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15490-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2025-48989 page", "url": "https://www.suse.com/security/cve/CVE-2025-48989/" } ], "title": "tomcat10-10.1.44-1.1 on GA media", "tracking": { "current_release_date": "2025-08-25T00:00:00Z", "generator": { "date": "2025-08-25T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2025:15490-1", "initial_release_date": "2025-08-25T00:00:00Z", "revision_history": [ { "date": "2025-08-25T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "tomcat10-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-10.1.44-1.1.aarch64", "product_id": "tomcat10-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-admin-webapps-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-admin-webapps-10.1.44-1.1.aarch64", "product_id": "tomcat10-admin-webapps-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-doc-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-doc-10.1.44-1.1.aarch64", "product_id": "tomcat10-doc-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-docs-webapp-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-docs-webapp-10.1.44-1.1.aarch64", "product_id": "tomcat10-docs-webapp-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-el-5_0-api-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-el-5_0-api-10.1.44-1.1.aarch64", "product_id": "tomcat10-el-5_0-api-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-embed-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-embed-10.1.44-1.1.aarch64", "product_id": "tomcat10-embed-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64", "product_id": "tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-jsvc-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-jsvc-10.1.44-1.1.aarch64", "product_id": "tomcat10-jsvc-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-lib-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-lib-10.1.44-1.1.aarch64", "product_id": "tomcat10-lib-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64", "product_id": "tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat10-webapps-10.1.44-1.1.aarch64", "product": { "name": "tomcat10-webapps-10.1.44-1.1.aarch64", "product_id": "tomcat10-webapps-10.1.44-1.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "tomcat10-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-10.1.44-1.1.ppc64le", "product_id": "tomcat10-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-admin-webapps-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-admin-webapps-10.1.44-1.1.ppc64le", "product_id": "tomcat10-admin-webapps-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-doc-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-doc-10.1.44-1.1.ppc64le", "product_id": "tomcat10-doc-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-docs-webapp-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-docs-webapp-10.1.44-1.1.ppc64le", "product_id": "tomcat10-docs-webapp-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-el-5_0-api-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-el-5_0-api-10.1.44-1.1.ppc64le", "product_id": "tomcat10-el-5_0-api-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-embed-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-embed-10.1.44-1.1.ppc64le", "product_id": "tomcat10-embed-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le", "product_id": "tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-jsvc-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-jsvc-10.1.44-1.1.ppc64le", "product_id": "tomcat10-jsvc-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-lib-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-lib-10.1.44-1.1.ppc64le", "product_id": "tomcat10-lib-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le", "product_id": "tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat10-webapps-10.1.44-1.1.ppc64le", "product": { "name": "tomcat10-webapps-10.1.44-1.1.ppc64le", "product_id": "tomcat10-webapps-10.1.44-1.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "tomcat10-10.1.44-1.1.s390x", "product": { "name": "tomcat10-10.1.44-1.1.s390x", "product_id": "tomcat10-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-admin-webapps-10.1.44-1.1.s390x", "product": { "name": "tomcat10-admin-webapps-10.1.44-1.1.s390x", "product_id": "tomcat10-admin-webapps-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-doc-10.1.44-1.1.s390x", "product": { "name": "tomcat10-doc-10.1.44-1.1.s390x", "product_id": "tomcat10-doc-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-docs-webapp-10.1.44-1.1.s390x", "product": { "name": "tomcat10-docs-webapp-10.1.44-1.1.s390x", "product_id": "tomcat10-docs-webapp-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-el-5_0-api-10.1.44-1.1.s390x", "product": { "name": "tomcat10-el-5_0-api-10.1.44-1.1.s390x", "product_id": "tomcat10-el-5_0-api-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-embed-10.1.44-1.1.s390x", "product": { "name": "tomcat10-embed-10.1.44-1.1.s390x", "product_id": "tomcat10-embed-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.s390x", "product": { "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.s390x", "product_id": "tomcat10-jsp-3_1-api-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-jsvc-10.1.44-1.1.s390x", "product": { "name": "tomcat10-jsvc-10.1.44-1.1.s390x", "product_id": "tomcat10-jsvc-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-lib-10.1.44-1.1.s390x", "product": { "name": "tomcat10-lib-10.1.44-1.1.s390x", "product_id": "tomcat10-lib-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.s390x", "product": { "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.s390x", "product_id": "tomcat10-servlet-6_0-api-10.1.44-1.1.s390x" } }, { "category": "product_version", "name": "tomcat10-webapps-10.1.44-1.1.s390x", "product": { "name": "tomcat10-webapps-10.1.44-1.1.s390x", "product_id": "tomcat10-webapps-10.1.44-1.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "tomcat10-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-10.1.44-1.1.x86_64", "product_id": "tomcat10-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-admin-webapps-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-admin-webapps-10.1.44-1.1.x86_64", "product_id": "tomcat10-admin-webapps-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-doc-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-doc-10.1.44-1.1.x86_64", "product_id": "tomcat10-doc-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-docs-webapp-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-docs-webapp-10.1.44-1.1.x86_64", "product_id": "tomcat10-docs-webapp-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-el-5_0-api-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-el-5_0-api-10.1.44-1.1.x86_64", "product_id": "tomcat10-el-5_0-api-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-embed-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-embed-10.1.44-1.1.x86_64", "product_id": "tomcat10-embed-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64", "product_id": "tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-jsvc-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-jsvc-10.1.44-1.1.x86_64", "product_id": "tomcat10-jsvc-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-lib-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-lib-10.1.44-1.1.x86_64", "product_id": "tomcat10-lib-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64", "product_id": "tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat10-webapps-10.1.44-1.1.x86_64", "product": { "name": "tomcat10-webapps-10.1.44-1.1.x86_64", "product_id": "tomcat10-webapps-10.1.44-1.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat10-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-admin-webapps-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-admin-webapps-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-admin-webapps-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-admin-webapps-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-admin-webapps-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-admin-webapps-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-admin-webapps-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-admin-webapps-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-doc-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-doc-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-doc-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-doc-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-doc-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-doc-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-doc-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-doc-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-docs-webapp-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-docs-webapp-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-docs-webapp-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-docs-webapp-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-docs-webapp-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-docs-webapp-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-docs-webapp-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-docs-webapp-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-el-5_0-api-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-el-5_0-api-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-el-5_0-api-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-el-5_0-api-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-el-5_0-api-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-el-5_0-api-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-el-5_0-api-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-el-5_0-api-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-embed-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-embed-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-embed-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-embed-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-embed-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-embed-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-embed-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-embed-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-jsp-3_1-api-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-jsvc-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-jsvc-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-jsvc-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-jsvc-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-jsvc-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-jsvc-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-jsvc-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-jsvc-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-lib-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-lib-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-lib-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-lib-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-lib-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-lib-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-lib-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-lib-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-servlet-6_0-api-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-webapps-10.1.44-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.aarch64" }, "product_reference": "tomcat10-webapps-10.1.44-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-webapps-10.1.44-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.ppc64le" }, "product_reference": "tomcat10-webapps-10.1.44-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-webapps-10.1.44-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.s390x" }, "product_reference": "tomcat10-webapps-10.1.44-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat10-webapps-10.1.44-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.x86_64" }, "product_reference": "tomcat10-webapps-10.1.44-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48989", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2025-48989" } ], "notes": [ { "category": "general", "text": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2025-48989", "url": "https://www.suse.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "SUSE Bug 1243888 for CVE-2025-48989", "url": "https://bugzilla.suse.com/1243888" }, { "category": "external", "summary": "SUSE Bug 1243895 for CVE-2025-48989", "url": "https://bugzilla.suse.com/1243895" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.44-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.44-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2025-08-25T00:00:00Z", "details": "important" } ], "title": "CVE-2025-48989" } ] }
opensuse-su-2025:15491-1
Vulnerability from csaf_opensuse
Published
2025-08-25 00:00
Modified
2025-08-25 00:00
Summary
tomcat11-11.0.10-1.1 on GA media
Notes
Title of the patch
tomcat11-11.0.10-1.1 on GA media
Description of the patch
These are all security issues fixed in the tomcat11-11.0.10-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15491
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "tomcat11-11.0.10-1.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the tomcat11-11.0.10-1.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2025-15491", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15491-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2025-48989 page", "url": "https://www.suse.com/security/cve/CVE-2025-48989/" } ], "title": "tomcat11-11.0.10-1.1 on GA media", "tracking": { "current_release_date": "2025-08-25T00:00:00Z", "generator": { "date": "2025-08-25T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2025:15491-1", "initial_release_date": "2025-08-25T00:00:00Z", "revision_history": [ { "date": "2025-08-25T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "tomcat11-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-11.0.10-1.1.aarch64", "product_id": "tomcat11-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-admin-webapps-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-admin-webapps-11.0.10-1.1.aarch64", "product_id": "tomcat11-admin-webapps-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-doc-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-doc-11.0.10-1.1.aarch64", "product_id": "tomcat11-doc-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-docs-webapp-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-docs-webapp-11.0.10-1.1.aarch64", "product_id": "tomcat11-docs-webapp-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-el-6_0-api-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-el-6_0-api-11.0.10-1.1.aarch64", "product_id": "tomcat11-el-6_0-api-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-embed-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-embed-11.0.10-1.1.aarch64", "product_id": "tomcat11-embed-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64", "product_id": "tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-jsvc-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-jsvc-11.0.10-1.1.aarch64", "product_id": "tomcat11-jsvc-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-lib-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-lib-11.0.10-1.1.aarch64", "product_id": "tomcat11-lib-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64", "product_id": "tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64" } }, { "category": "product_version", "name": "tomcat11-webapps-11.0.10-1.1.aarch64", "product": { "name": "tomcat11-webapps-11.0.10-1.1.aarch64", "product_id": "tomcat11-webapps-11.0.10-1.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "tomcat11-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-11.0.10-1.1.ppc64le", "product_id": "tomcat11-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-admin-webapps-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-admin-webapps-11.0.10-1.1.ppc64le", "product_id": "tomcat11-admin-webapps-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-doc-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-doc-11.0.10-1.1.ppc64le", "product_id": "tomcat11-doc-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-docs-webapp-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-docs-webapp-11.0.10-1.1.ppc64le", "product_id": "tomcat11-docs-webapp-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-el-6_0-api-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-el-6_0-api-11.0.10-1.1.ppc64le", "product_id": "tomcat11-el-6_0-api-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-embed-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-embed-11.0.10-1.1.ppc64le", "product_id": "tomcat11-embed-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le", "product_id": "tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-jsvc-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-jsvc-11.0.10-1.1.ppc64le", "product_id": "tomcat11-jsvc-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-lib-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-lib-11.0.10-1.1.ppc64le", "product_id": "tomcat11-lib-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le", "product_id": "tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le" } }, { "category": "product_version", "name": "tomcat11-webapps-11.0.10-1.1.ppc64le", "product": { "name": "tomcat11-webapps-11.0.10-1.1.ppc64le", "product_id": "tomcat11-webapps-11.0.10-1.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "tomcat11-11.0.10-1.1.s390x", "product": { "name": "tomcat11-11.0.10-1.1.s390x", "product_id": "tomcat11-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-admin-webapps-11.0.10-1.1.s390x", "product": { "name": "tomcat11-admin-webapps-11.0.10-1.1.s390x", "product_id": "tomcat11-admin-webapps-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-doc-11.0.10-1.1.s390x", "product": { "name": "tomcat11-doc-11.0.10-1.1.s390x", "product_id": "tomcat11-doc-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-docs-webapp-11.0.10-1.1.s390x", "product": { "name": "tomcat11-docs-webapp-11.0.10-1.1.s390x", "product_id": "tomcat11-docs-webapp-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-el-6_0-api-11.0.10-1.1.s390x", "product": { "name": "tomcat11-el-6_0-api-11.0.10-1.1.s390x", "product_id": "tomcat11-el-6_0-api-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-embed-11.0.10-1.1.s390x", "product": { "name": "tomcat11-embed-11.0.10-1.1.s390x", "product_id": "tomcat11-embed-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.s390x", "product": { "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.s390x", "product_id": "tomcat11-jsp-4_0-api-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-jsvc-11.0.10-1.1.s390x", "product": { "name": "tomcat11-jsvc-11.0.10-1.1.s390x", "product_id": "tomcat11-jsvc-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-lib-11.0.10-1.1.s390x", "product": { "name": "tomcat11-lib-11.0.10-1.1.s390x", "product_id": "tomcat11-lib-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.s390x", "product": { "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.s390x", "product_id": "tomcat11-servlet-6_1-api-11.0.10-1.1.s390x" } }, { "category": "product_version", "name": "tomcat11-webapps-11.0.10-1.1.s390x", "product": { "name": "tomcat11-webapps-11.0.10-1.1.s390x", "product_id": "tomcat11-webapps-11.0.10-1.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "tomcat11-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-11.0.10-1.1.x86_64", "product_id": "tomcat11-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-admin-webapps-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-admin-webapps-11.0.10-1.1.x86_64", "product_id": "tomcat11-admin-webapps-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-doc-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-doc-11.0.10-1.1.x86_64", "product_id": "tomcat11-doc-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-docs-webapp-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-docs-webapp-11.0.10-1.1.x86_64", "product_id": "tomcat11-docs-webapp-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-el-6_0-api-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-el-6_0-api-11.0.10-1.1.x86_64", "product_id": "tomcat11-el-6_0-api-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-embed-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-embed-11.0.10-1.1.x86_64", "product_id": "tomcat11-embed-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64", "product_id": "tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-jsvc-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-jsvc-11.0.10-1.1.x86_64", "product_id": "tomcat11-jsvc-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-lib-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-lib-11.0.10-1.1.x86_64", "product_id": "tomcat11-lib-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64", "product_id": "tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64" } }, { "category": "product_version", "name": "tomcat11-webapps-11.0.10-1.1.x86_64", "product": { "name": "tomcat11-webapps-11.0.10-1.1.x86_64", "product_id": "tomcat11-webapps-11.0.10-1.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat11-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-admin-webapps-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-admin-webapps-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-admin-webapps-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-admin-webapps-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-admin-webapps-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-admin-webapps-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-admin-webapps-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-admin-webapps-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-doc-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-doc-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-doc-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-doc-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-doc-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-doc-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-doc-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-doc-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-docs-webapp-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-docs-webapp-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-docs-webapp-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-docs-webapp-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-docs-webapp-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-docs-webapp-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-docs-webapp-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-docs-webapp-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-el-6_0-api-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-el-6_0-api-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-el-6_0-api-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-el-6_0-api-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-el-6_0-api-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-el-6_0-api-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-el-6_0-api-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-el-6_0-api-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-embed-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-embed-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-embed-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-embed-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-embed-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-embed-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-embed-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-embed-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-jsp-4_0-api-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsvc-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-jsvc-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsvc-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-jsvc-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsvc-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-jsvc-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsvc-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-jsvc-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-lib-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-lib-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-lib-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-lib-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-lib-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-lib-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-lib-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-lib-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-servlet-6_1-api-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-webapps-11.0.10-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.aarch64" }, "product_reference": "tomcat11-webapps-11.0.10-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-webapps-11.0.10-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.ppc64le" }, "product_reference": "tomcat11-webapps-11.0.10-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-webapps-11.0.10-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.s390x" }, "product_reference": "tomcat11-webapps-11.0.10-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-webapps-11.0.10-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.x86_64" }, "product_reference": "tomcat11-webapps-11.0.10-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48989", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2025-48989" } ], "notes": [ { "category": "general", "text": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2025-48989", "url": "https://www.suse.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "SUSE Bug 1243888 for CVE-2025-48989", "url": "https://bugzilla.suse.com/1243888" }, { "category": "external", "summary": "SUSE Bug 1243895 for CVE-2025-48989", "url": "https://bugzilla.suse.com/1243895" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-admin-webapps-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-doc-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-docs-webapp-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-el-6_0-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-embed-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-jsp-4_0-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-jsvc-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-lib-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-servlet-6_1-api-11.0.10-1.1.x86_64", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.aarch64", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.ppc64le", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.s390x", "openSUSE Tumbleweed:tomcat11-webapps-11.0.10-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2025-08-25T00:00:00Z", "details": "important" } ], "title": "CVE-2025-48989" } ] }
suse-su-2025:02992-1
Vulnerability from csaf_suse
Published
2025-08-27 11:57
Modified
2025-08-27 11:57
Summary
Security update for tomcat11
Notes
Title of the patch
Security update for tomcat11
Description of the patch
This update for tomcat11 fixes the following issues:
Updated to Tomcat 11.0.10
- CVE-2025-48989: Fixed 'MadeYouReset' DoS in HTTP/2 due to client triggered stream reset (bsc#1243895)
Other fixes:
* Catalina
+ Fix: Fix bloom filter population for archive indexing when using a
packed WAR containing one or more JAR files. (markt)
* Coyote
+ Fix: 69748: Add missing call to set keep-alive timeout when using
HTTP/1.1 following an async request, which was present for AJP.
(remm/markt)
+ Fix: 69762: Fix possible overflow during HPACK decoding of integers.
Note that the maximum permitted value of an HPACK decoded integer is
Integer.MAX_VALUE. (markt)
+ Fix: Update the HTTP/2 overhead documentation - particularly the code
comments - to reflect the deprecation of the PRIORITY frame and
clarify that a stream reset always triggers an overhead increase.
(markt)
* Cluster
+ Update: Add enableStatistics configuration attribute for the
DeltaManager, defaulting to true. (remm)
* WebSocket
+ Fix: Align the WebSocket extension handling for WebSocket client
connections with WebSocket server connections. The WebSocket client
now only includes an extension requested by an endpoint in the
opening handshake if the WebSocket client supports that extension.
(markt)
* Web applications
+ Fix: Manager and Host Manager. Provide the Manager and Host Manager
web applications with a dedicated favicon file rather than using the
one from the ROOT web application which might not be present or may
represent something entirely different. Pull requests #876 and #878
by Simon Arame.
* Other
+ Update: Update Checkstyle to 10.26.1. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations by tak7iji. (markt)
Patchnames
SUSE-2025-2992,SUSE-SLE-Module-Web-Scripting-15-SP6-2025-2992,SUSE-SLE-Module-Web-Scripting-15-SP7-2025-2992,openSUSE-SLE-15.6-2025-2992
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for tomcat11", "title": "Title of the patch" }, { "category": "description", "text": "This update for tomcat11 fixes the following issues:\n\nUpdated to Tomcat 11.0.10\n- CVE-2025-48989: Fixed \u0027MadeYouReset\u0027 DoS in HTTP/2 due to client triggered stream reset (bsc#1243895)\n \nOther fixes:\n * Catalina\n + Fix: Fix bloom filter population for archive indexing when using a\n packed WAR containing one or more JAR files. (markt)\n * Coyote\n + Fix: 69748: Add missing call to set keep-alive timeout when using\n HTTP/1.1 following an async request, which was present for AJP.\n (remm/markt)\n + Fix: 69762: Fix possible overflow during HPACK decoding of integers.\n Note that the maximum permitted value of an HPACK decoded integer is\n Integer.MAX_VALUE. (markt)\n + Fix: Update the HTTP/2 overhead documentation - particularly the code\n comments - to reflect the deprecation of the PRIORITY frame and\n clarify that a stream reset always triggers an overhead increase.\n (markt)\n * Cluster\n + Update: Add enableStatistics configuration attribute for the\n DeltaManager, defaulting to true. (remm)\n * WebSocket\n + Fix: Align the WebSocket extension handling for WebSocket client\n connections with WebSocket server connections. The WebSocket client\n now only includes an extension requested by an endpoint in the\n opening handshake if the WebSocket client supports that extension.\n (markt)\n * Web applications\n + Fix: Manager and Host Manager. Provide the Manager and Host Manager\n web applications with a dedicated favicon file rather than using the\n one from the ROOT web application which might not be present or may\n represent something entirely different. Pull requests #876 and #878\n by Simon Arame.\n * Other\n + Update: Update Checkstyle to 10.26.1. (markt)\n + Add: Improvements to French translations. (remm)\n + Add: Improvements to Japanese translations by tak7iji. (markt)\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-2025-2992,SUSE-SLE-Module-Web-Scripting-15-SP6-2025-2992,SUSE-SLE-Module-Web-Scripting-15-SP7-2025-2992,openSUSE-SLE-15.6-2025-2992", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_02992-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2025:02992-1", "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202502992-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2025:02992-1", "url": "https://lists.suse.com/pipermail/sle-updates/2025-August/041365.html" }, { "category": "self", "summary": "SUSE Bug 1243895", "url": "https://bugzilla.suse.com/1243895" }, { "category": "self", "summary": "SUSE CVE CVE-2025-48989 page", "url": "https://www.suse.com/security/cve/CVE-2025-48989/" } ], "title": "Security update for tomcat11", "tracking": { "current_release_date": "2025-08-27T11:57:03Z", "generator": { "date": "2025-08-27T11:57:03Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2025:02992-1", "initial_release_date": "2025-08-27T11:57:03Z", "revision_history": [ { "date": "2025-08-27T11:57:03Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "tomcat11-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-doc-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-doc-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-doc-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-embed-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-embed-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-embed-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-jsvc-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-jsvc-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-jsvc-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-lib-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-lib-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-lib-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch" } }, { "category": "product_version", "name": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "product": { "name": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "product_id": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch" } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product": { "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-web-scripting:15:sp6" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product": { "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-web-scripting:15:sp7" } } }, { "category": "product_name", "name": "openSUSE Leap 15.6", "product": { "name": "openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.6" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat11-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-lib-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-lib-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-lib-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-webapps-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-lib-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-lib-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7", "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-doc-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-doc-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-doc-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-embed-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-embed-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-embed-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-jsvc-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-jsvc-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-jsvc-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-lib-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-lib-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-lib-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch as component of openSUSE Leap 15.6", "product_id": "openSUSE Leap 15.6:tomcat11-webapps-11.0.10-150600.13.9.1.noarch" }, "product_reference": "tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48989", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2025-48989" } ], "notes": [ { "category": "general", "text": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-doc-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-embed-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-jsvc-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-webapps-11.0.10-150600.13.9.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2025-48989", "url": "https://www.suse.com/security/cve/CVE-2025-48989" }, { "category": "external", "summary": "SUSE Bug 1243888 for CVE-2025-48989", "url": "https://bugzilla.suse.com/1243888" }, { "category": "external", "summary": "SUSE Bug 1243895 for CVE-2025-48989", "url": "https://bugzilla.suse.com/1243895" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-doc-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-embed-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-jsvc-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-webapps-11.0.10-150600.13.9.1.noarch" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-doc-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-embed-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-jsvc-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-lib-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.10-150600.13.9.1.noarch", "openSUSE Leap 15.6:tomcat11-webapps-11.0.10-150600.13.9.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2025-08-27T11:57:03Z", "details": "important" } ], "title": "CVE-2025-48989" } ] }
fkie_cve-2025-48989
Vulnerability from fkie_nvd
Published
2025-08-13 13:15
Modified
2025-08-18 18:34
Severity ?
Summary
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.
Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
References
▼ | URL | Tags | |
---|---|---|---|
security@apache.org | https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf | Mailing List, Vendor Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
apache | tomcat | * | |
apache | tomcat | * | |
apache | tomcat | * | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 | |
apache | tomcat | 9.0.0 |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB3FEF17-23FB-460F-AEF8-FDBA52DC2B3F", "versionEndExcluding": "9.0.108", "versionStartIncluding": "9.0.1", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "matchCriteriaId": "0820A463-9915-448C-9EC0-49F79D12708A", "versionEndExcluding": "10.1.44", "versionStartIncluding": "10.0.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA7FF893-81BF-455F-A9D5-47D6A6F9E6E9", "versionEndExcluding": "11.0.10", "versionStartIncluding": "11.0.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*", "matchCriteriaId": "9D0689FE-4BC0-4F53-8C79-34B21F9B86C2", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*", "matchCriteriaId": "89B129B2-FB6F-4EF9-BF12-E589A87996CF", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*", "matchCriteriaId": "8B6787B6-54A8-475E-BA1C-AB99334B2535", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*", "matchCriteriaId": "EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*", "matchCriteriaId": "E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*", "matchCriteriaId": "8A6DA0BE-908C-4DA8-A191-A0113235E99A", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*", "matchCriteriaId": "39029C72-28B4-46A4-BFF5-EC822CFB2A4C", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*", "matchCriteriaId": "1A2E05A3-014F-4C4D-81E5-88E725FBD6AD", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*", "matchCriteriaId": "166C533C-0833-41D5-99B6-17A4FAB3CAF0", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*", "matchCriteriaId": "D3768C60-21FA-4B92-B98C-C3A2602D1BC4", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*", "matchCriteriaId": "DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*", "matchCriteriaId": "9F542E12-6BA8-4504-A494-DA83E7E19BD5", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*", "matchCriteriaId": "C2409CC7-6A85-4A66-A457-0D62B9895DC1", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*", "matchCriteriaId": "B392A7E5-4455-4B1C-8FAC-AE6DDC70689E", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*", "matchCriteriaId": "EF411DDA-2601-449A-9046-D250419A0E1A", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*", "matchCriteriaId": "D7D8F2F4-AFE2-47EA-A3FD-79B54324DE02", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*", "matchCriteriaId": "1B4FBF97-DE16-4E5E-BE19-471E01818D40", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*", "matchCriteriaId": "3B266B1E-24B5-47EE-A421-E0E3CC0C7471", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*", "matchCriteriaId": "29614C3A-6FB3-41C7-B56E-9CC3F45B04F0", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*", "matchCriteriaId": "C6AB156C-8FF6-4727-AF75-590D0DCB3F9D", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*", "matchCriteriaId": "C0C5F004-F7D8-45DB-B173-351C50B0EC16", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*", "matchCriteriaId": "D1902D2E-1896-4D3D-9E1C-3A675255072C", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*", "matchCriteriaId": "49AAF4DF-F61D-47A8-8788-A21E317A145D", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*", "matchCriteriaId": "454211D0-60A2-4661-AECA-4C0121413FEB", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*", "matchCriteriaId": "0686F977-889F-4960-8E0B-7784B73A7F2D", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*", "matchCriteriaId": "558703AE-DB5E-4DFF-B497-C36694DD7B24", "vulnerable": true }, { "criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*", "matchCriteriaId": "ED6273F2-1165-47A4-8DD7-9E9B2472941B", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue." }, { "lang": "es", "value": "Una vulnerabilidad de apagado o liberaci\u00f3n incorrecta de recursos en Apache Tomcat lo hizo vulnerable al ataque \"Maked You Reset\". Este problema afecta a Apache Tomcat desde la versi\u00f3n 11.0.0-M1 hasta la 11.0.9, desde la 10.1.0-M1 hasta la 10.1.43 y desde la 9.0.0.M1 hasta la 9.0.107. Las versiones anteriores al final de su vida \u00fatil tambi\u00e9n pueden verse afectadas. Se recomienda actualizar a una de las versiones 11.0.10, 10.1.44 o 9.0.108, que solucionan el problema." } ], "id": "CVE-2025-48989", "lastModified": "2025-08-18T18:34:04.980", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] }, "published": "2025-08-13T13:15:34.153", "references": [ { "source": "security@apache.org", "tags": [ "Mailing List", "Vendor Advisory" ], "url": "https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf" } ], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-404" } ], "source": "security@apache.org", "type": "Secondary" } ] }
wid-sec-w-2025-1830
Vulnerability from csaf_certbund
Published
2025-08-13 22:00
Modified
2025-09-02 22:00
Summary
http/2 Implementierungen: Schwachstelle ermöglicht Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
http/2 ist das HyperText Transfer Protocol in Version 2.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiednen http/2 Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- Sonstiges
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "http/2 ist das HyperText Transfer Protocol in Version 2.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiednen http/2 Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2025-1830 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1830.json" }, { "category": "self", "summary": "WID-SEC-2025-1830 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1830" }, { "category": "external", "summary": "Gal Bar Nahum\u0027s Blog - MadeYouReset Series vom 2025-08-13", "url": "https://galbarnahum.com/made-you-reset" }, { "category": "external", "summary": "CERT/CC VU#767506 vom 2025-08-13", "url": "https://kb.cert.org/vuls/id/767506" }, { "category": "external", "summary": "Varnish Security Advisory VSV00017 vom 2025-08-13", "url": "https://varnish-cache.org/security/VSV00017.html" }, { "category": "external", "summary": "Mailing List OSS Security vom 2025-08-13", "url": "https://seclists.org/oss-sec/2025/q3/95" }, { "category": "external", "summary": "Tomcat 9 Security vom 2025-08-13", "url": "https://tomcat.apache.org/security-9.html" }, { "category": "external", "summary": "Tomcat 10 Security vom 2025-08-13", "url": "https://tomcat.apache.org/security-10.html" }, { "category": "external", "summary": "Tomcat 11 Security vom 2025-08-13", "url": "https://tomcat.apache.org/security-11.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:13686 vom 2025-08-13", "url": "https://access.redhat.com/errata/RHSA-2025:13686" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:13685 vom 2025-08-14", "url": "https://access.redhat.com/errata/RHSA-2025:13685" }, { "category": "external", "summary": "openSUSE Security Update OPENSUSE-SU-2025:15449-1 vom 2025-08-16", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LD37QPQBLKIFMKWJXACHGPA7WALFCOM7/" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14004 vom 2025-08-19", "url": "https://access.redhat.com/errata/RHSA-2025:14004" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14008 vom 2025-08-19", "url": "https://access.redhat.com/errata/RHSA-2025:14008" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14182 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14177 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14180 vom 2025-08-21", "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "category": "external", "summary": "GitHub Security Advisory GHSA-MMXM-8W33-WC4H vom 2025-08-20", "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14179 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14178 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14183 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14183" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2025-14177 vom 2025-08-21", "url": "https://linux.oracle.com/errata/ELSA-2025-14177.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14197 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14197" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14181 vom 2025-08-20", "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2025-14181 vom 2025-08-21", "url": "https://linux.oracle.com/errata/ELSA-2025-14181.html" }, { "category": "external", "summary": "New Varnish Cache releases (7.7.3, 7.6.5 and 6.0.16) vom 2025-08-20", "url": "https://varnish-cache.org/lists/pipermail/varnish-announce/2025-August/000771.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2025-14178 vom 2025-08-21", "url": "https://linux.oracle.com/errata/ELSA-2025-14178.html" }, { "category": "external", "summary": "PoC CVE-2025-8671 vom 2025-08-24", "url": "https://github.com/abiyeenzo/CVE-2025-8671" }, { "category": "external", "summary": "openSUSE Security Update OPENSUSE-SU-2025:15483-1 vom 2025-08-23", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EXDF5TMMN4LHEDWLII7MMDPWQR5D6UWU/" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2025-14179 vom 2025-08-22", "url": "https://linux.oracle.com/errata/ELSA-2025-14179.html" }, { "category": "external", "summary": "openSUSE Security Update OPENSUSE-SU-2025:15490-1 vom 2025-08-26", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HVS2SK75HFDIVZCEQSOAOL6TTJCJFJZK/" }, { "category": "external", "summary": "openSUSE Security Update OPENSUSE-SU-2025:15491-1 vom 2025-08-26", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PFPY4ZCVL2NZMRDOWWAY4ZBXIIA663BF/" }, { "category": "external", "summary": "openSUSE Security Update OPENSUSE-SU-2025:15489-1 vom 2025-08-26", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UBHMT4B4D7HRMDPQJYDEV5UUSG7LVAHI/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:02992-1 vom 2025-08-27", "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-August/022280.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:02993-1 vom 2025-08-27", "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-August/022294.html" }, { "category": "external", "summary": "Camunda Security Notice 144 vom 2025-08-28", "url": "https://docs.camunda.org/security/notices/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:03006-1 vom 2025-08-28", "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-August/022326.html" }, { "category": "external", "summary": "ATOSS Sicherheitsmitteilung: Apache Tomcat-Sicherheitsl\u00fccken vom 2025-08-28", "url": "https://www.atoss.ch/de-ch/sicherheit/security-news" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14911 vom 2025-08-28", "url": "https://access.redhat.com/errata/RHSA-2025:14911" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:03024-1 vom 2025-08-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-August/022345.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:03021-1 vom 2025-08-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-August/022331.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:02993-2 vom 2025-09-01", "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-September/022373.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2025:02993-2 vom 2025-09-01", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WDVRXONEUUASOWSNXL4RQLFHU45FFDH6/" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14919 vom 2025-09-03", "url": "https://access.redhat.com/errata/RHSA-2025:14919" } ], "source_lang": "en-US", "title": "http/2 Implementierungen: Schwachstelle erm\u00f6glicht Denial of Service", "tracking": { "current_release_date": "2025-09-02T22:00:00.000+00:00", "generator": { "date": "2025-09-03T07:06:15.985+00:00", "engine": { "name": "BSI-WID", "version": "1.4.0" } }, "id": "WID-SEC-W-2025-1830", "initial_release_date": "2025-08-13T22:00:00.000+00:00", "revision_history": [ { "date": "2025-08-13T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2025-08-17T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von openSUSE aufgenommen" }, { "date": "2025-08-19T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2025-08-20T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat, Open Source, Oracle Linux und European Union Vulnerability Database aufgenommen" }, { "date": "2025-08-21T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2025-08-24T22:00:00.000+00:00", "number": "6", "summary": "PoC aufgenommen" }, { "date": "2025-08-26T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von openSUSE aufgenommen" }, { "date": "2025-08-27T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2025-08-28T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von SUSE und Red Hat aufgenommen" }, { "date": "2025-08-31T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2025-09-01T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2025-09-02T22:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "12" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "ATOSS Staff Efficiency Suite", "product": { "name": "ATOSS Staff Efficiency Suite", "product_id": "T041371", "product_identification_helper": { "cpe": "cpe:/a:atoss:staff_efficiency_suite:-" } } } ], "category": "vendor", "name": "ATOSS" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c11.0.10", "product": { "name": "Apache Tomcat \u003c11.0.10", "product_id": "1821869" } }, { "category": "product_version", "name": "11.0.10", "product": { "name": "Apache Tomcat 11.0.10", "product_id": "1821869-fixed", "product_identification_helper": { "cpe": "cpe:/a:apache:tomcat:11.0.10" } } }, { "category": "product_version_range", "name": "\u003c9.0.108", "product": { "name": "Apache Tomcat \u003c9.0.108", "product_id": "1821870" } }, { "category": "product_version", "name": "9.0.108", "product": { "name": "Apache Tomcat 9.0.108", "product_id": "1821870-fixed", "product_identification_helper": { "cpe": "cpe:/a:apache:tomcat:9.0.108" } } }, { "category": "product_version_range", "name": "\u003c10.1.44", "product": { "name": "Apache Tomcat \u003c10.1.44", "product_id": "T046241" } }, { "category": "product_version", "name": "10.1.44", "product": { "name": "Apache Tomcat 10.1.44", "product_id": "T046241-fixed", "product_identification_helper": { "cpe": "cpe:/a:apache:tomcat:10.1.44" } } } ], "category": "product_name", "name": "Tomcat" } ], "category": "vendor", "name": "Apache" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c9.4.58", "product": { "name": "Eclipse Jetty \u003c9.4.58", "product_id": "T046367" } }, { "category": "product_version", "name": "9.4.58", "product": { "name": "Eclipse Jetty 9.4.58", "product_id": "T046367-fixed", "product_identification_helper": { "cpe": "cpe:/a:eclipse:jetty:9.4.58" } } }, { "category": "product_version_range", "name": "\u003c10.0.26", "product": { "name": "Eclipse Jetty \u003c10.0.26", "product_id": "T046368" } }, { "category": "product_version", "name": "10.0.26", "product": { "name": "Eclipse Jetty 10.0.26", "product_id": "T046368-fixed", "product_identification_helper": { "cpe": "cpe:/a:eclipse:jetty:10.0.26" } } }, { "category": "product_version_range", "name": "\u003c11.0.26", "product": { "name": "Eclipse Jetty \u003c11.0.26", "product_id": "T046369" } }, { "category": "product_version", "name": "11.0.26", "product": { "name": "Eclipse Jetty 11.0.26", "product_id": "T046369-fixed", "product_identification_helper": { "cpe": "cpe:/a:eclipse:jetty:11.0.26" } } }, { "category": "product_version_range", "name": "\u003c12.0.25", "product": { "name": "Eclipse Jetty \u003c12.0.25", "product_id": "T046370" } }, { "category": "product_version", "name": "12.0.25", "product": { "name": "Eclipse Jetty 12.0.25", "product_id": "T046370-fixed", "product_identification_helper": { "cpe": "cpe:/a:eclipse:jetty:12.0.25" } } }, { "category": "product_version_range", "name": "\u003c12.1.0.beta3", "product": { "name": "Eclipse Jetty \u003c12.1.0.beta3", "product_id": "T046371" } }, { "category": "product_version", "name": "12.1.0.beta3", "product": { "name": "Eclipse Jetty 12.1.0.beta3", "product_id": "T046371-fixed", "product_identification_helper": { "cpe": "cpe:/a:eclipse:jetty:12.1.0.beta3" } } } ], "category": "product_name", "name": "Jetty" } ], "category": "vendor", "name": "Eclipse" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "Optimize \u003c3.15.7", "product": { "name": "Open Source Camunda Optimize \u003c3.15.7", "product_id": "T046585" } }, { "category": "product_version", "name": "Optimize 3.15.7", "product": { "name": "Open Source Camunda Optimize 3.15.7", "product_id": "T046585-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:optimize_3.15.7" } } }, { "category": "product_version_range", "name": "Optimize \u003c3.14.8", "product": { "name": "Open Source Camunda Optimize \u003c3.14.8", "product_id": "T046586" } }, { "category": "product_version", "name": "Optimize 3.14.8", "product": { "name": "Open Source Camunda Optimize 3.14.8", "product_id": "T046586-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:optimize_3.14.8" } } }, { "category": "product_version_range", "name": "Optimize \u003c3.13.19", "product": { "name": "Open Source Camunda Optimize \u003c3.13.19", "product_id": "T046587" } }, { "category": "product_version", "name": "Optimize 3.13.19", "product": { "name": "Open Source Camunda Optimize 3.13.19", "product_id": "T046587-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:optimize_3.13.19" } } } ], "category": "product_name", "name": "Camunda" }, { "branches": [ { "category": "product_version_range", "name": "\u003c7.6.4", "product": { "name": "Open Source Varnish HTTP Cache \u003c7.6.4", "product_id": "T046242" } }, { "category": "product_version", "name": "7.6.4", "product": { "name": "Open Source Varnish HTTP Cache 7.6.4", "product_id": "T046242-fixed", "product_identification_helper": { "cpe": "cpe:/a:varnish_http_accelerator_integration_project:varnish:7.6.4" } } }, { "category": "product_version_range", "name": "\u003c7.7.2", "product": { "name": "Open Source Varnish HTTP Cache \u003c7.7.2", "product_id": "T046243" } }, { "category": "product_version", "name": "7.7.2", "product": { "name": "Open Source Varnish HTTP Cache 7.7.2", "product_id": "T046243-fixed", "product_identification_helper": { "cpe": "cpe:/a:varnish_http_accelerator_integration_project:varnish:7.7.2" } } }, { "category": "product_version_range", "name": "\u003c6.0.15", "product": { "name": "Open Source Varnish HTTP Cache \u003c6.0.15", "product_id": "T046244" } }, { "category": "product_version", "name": "6.0.15", "product": { "name": "Open Source Varnish HTTP Cache 6.0.15", "product_id": "T046244-fixed", "product_identification_helper": { "cpe": "cpe:/a:varnish_http_accelerator_integration_project:varnish:6.0.15" } } } ], "category": "product_name", "name": "Varnish HTTP Cache" }, { "category": "product_name", "name": "Open Source lighttpd", "product": { "name": "Open Source lighttpd", "product_id": "T000812", "product_identification_helper": { "cpe": "cpe:/a:lighttpd:lighttpd:-" } } } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "category": "product_version", "name": "Apache Camel 1", "product": { "name": "Red Hat Enterprise Linux Apache Camel 1", "product_id": "T044468", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:apache_camel_1" } } }, { "category": "product_version", "name": "Quarkus 3.15.6.SP1", "product": { "name": "Red Hat Enterprise Linux Quarkus 3.15.6.SP1", "product_id": "T046330", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:quarkus_3.15.6.sp1" } } }, { "category": "product_version", "name": "Quarkus 3.20.2.SP1", "product": { "name": "Red Hat Enterprise Linux Quarkus 3.20.2.SP1", "product_id": "T046331", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:quarkus_3.20.2.sp1" } } } ], "category": "product_name", "name": "Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "Camel for Spring Boot 1", "product": { "name": "Red Hat Integration Camel for Spring Boot 1", "product_id": "T035240", "product_identification_helper": { "cpe": "cpe:/a:redhat:integration:camel_for_spring_boot_1" } } } ], "category": "product_name", "name": "Integration" }, { "branches": [ { "category": "product_version_range", "name": "\u003c6.1.2", "product": { "name": "Red Hat JBoss Web Server \u003c6.1.2", "product_id": "T046251" } }, { "category": "product_version", "name": "6.1.2", "product": { "name": "Red Hat JBoss Web Server 6.1.2", "product_id": "T046251-fixed", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.1.2" } } } ], "category": "product_name", "name": "JBoss Web Server" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } }, { "category": "product_name", "name": "SUSE openSUSE", "product": { "name": "SUSE openSUSE", "product_id": "T027843", "product_identification_helper": { "cpe": "cpe:/o:suse:opensuse:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Specification http/2", "product": { "name": "Specification http/2", "product_id": "T030386", "product_identification_helper": { "cpe": "cpe:/a:ietf:http2:-" } } } ], "category": "vendor", "name": "Specification" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-48989", "product_status": { "known_affected": [ "T030386", "T046370", "67646", "T046371", "T004914", "T000812", "1821870", "T046330", "T046331", "T046251", "T035240", "1821869", "T046369", "T041371", "T044468", "T002207", "T027843", "T046242", "T046243", "T046241", "T046367", "T046587", "T046368", "T046244", "T046585", "T046586" ] }, "release_date": "2025-08-13T22:00:00.000+00:00", "title": "CVE-2025-48989" }, { "cve": "CVE-2025-5115", "product_status": { "known_affected": [ "T030386", "T046370", "67646", "T046371", "T004914", "T000812", "1821870", "T046330", "T046331", "T046251", "T035240", "1821869", "T046369", "T041371", "T044468", "T002207", "T027843", "T046242", "T046243", "T046241", "T046367", "T046587", "T046368", "T046244", "T046585", "T046586" ] }, "release_date": "2025-08-13T22:00:00.000+00:00", "title": "CVE-2025-5115" }, { "cve": "CVE-2025-55163", "product_status": { "known_affected": [ "T030386", "T046370", "67646", "T046371", "T004914", "T000812", "1821870", "T046330", "T046331", "T046251", "T035240", "1821869", "T046369", "T041371", "T044468", "T002207", "T027843", "T046242", "T046243", "T046241", "T046367", "T046587", "T046368", "T046244", "T046585", "T046586" ] }, "release_date": "2025-08-13T22:00:00.000+00:00", "title": "CVE-2025-55163" }, { "cve": "CVE-2025-8671", "product_status": { "known_affected": [ "T030386", "T046370", "67646", "T046371", "T004914", "T000812", "1821870", "T046330", "T046331", "T046251", "T035240", "1821869", "T046369", "T041371", "T044468", "T002207", "T027843", "T046242", "T046243", "T046241", "T046367", "T046587", "T046368", "T046244", "T046585", "T046586" ] }, "release_date": "2025-08-13T22:00:00.000+00:00", "title": "CVE-2025-8671" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…