Red Hat Security Advisory

RHSA-2025:14178

tomcat9 security update

Released 2025-08-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) tomcat9-1:9.0.87-5.el10_0.3, tomcat9-admin-webapps-1:9.0.87-5.el10_0.3, tomcat9-docs-webapp-1:9.0.87-5.el10_0.3 +5

Fixes 7 records

TI-2025-31104 CVE-2025-48976 · GHSA-vv7r-c36w-3prj

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

MEDIUM 64

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.32877 Published 2025-06-16 Partial fix · 1.6, 2.0.0-M4 +1 CWE-770

TI-2025-31116 CVE-2025-48988 · GHSA-h3gc-qfqq-6h8f

Apache Tomcat: FileUpload large number of parts with headers DoS

MEDIUM 62

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.30433 Published 2025-06-16 Partial fix · 11.0.8, 10.1.42 +1 CWE-770

TI-2025-31206 CVE-2025-49125 · GHSA-wc4r-xq3c-5cf3

Apache Tomcat: Security constraint bypass for pre/post-resources

MEDIUM 45

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03437 Published 2025-06-16 Partial fix · 11.0.8, 10.1.42 +1 CWE-288

TI-2025-31117 CVE-2025-48989 · GHSA-gqp3-2cvr-x8m3

Apache Tomcat: h2 DoS - Made You Reset

MEDIUM 45

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03768 Published 2025-08-13 Partial fix · 11.0.10, 10.1.44 +1 CWE-404

TI-2025-33451 CVE-2025-53506 · GHSA-25xr-qj8w-c4vf

Apache Tomcat: DoS via excessive h2 streams at connection start

MEDIUM 43

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02129 Published 2025-07-10 Partial fix · 11.0.9, 10.1.43 +1 CWE-400

TI-2025-32628 CVE-2025-52520 · GHSA-wr62-c79q-cv37

Apache Tomcat: DoS via integer overflow in multipart file upload

MEDIUM 43

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02198 Published 2025-07-10 Partial fix · 11.0.9, 10.1.43 +1 CWE-190

TI-2025-32571 CVE-2025-52434 · GHSA-4j3c-42xv-3f84

Apache Tomcat: APR/Native Connector crash leading to DoS

MEDIUM 43

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02074 Published 2025-07-10 Partial fix · 9.0.107 CWE-362