Red Hat Security AdvisoryRHSA-2025:14182
tomcat security update
Released 2025-08-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.8.8) tomcat-1:9.0.87-1.el8_8.7, tomcat-admin-webapps-1:9.0.87-1.el8_8.7, tomcat-docs-webapp-1:9.0.87-1.el8_8.7 +5
- Red Hat Enterprise Linux AppStream TUS (v.8.8) tomcat-1:9.0.87-1.el8_8.7, tomcat-admin-webapps-1:9.0.87-1.el8_8.7, tomcat-docs-webapp-1:9.0.87-1.el8_8.7 +5
Fixes 7 records
Priority MEDIUM 64
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.32877 · Published 2025-06-16 · Partial fix · 1.6, 2.0.0-M4 +1 CWE-770
Priority MEDIUM 62
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.30433 · Published 2025-06-16 · Partial fix · 11.0.8, 10.1.42 +1 CWE-770
Priority MEDIUM 45
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03437 · Published 2025-06-16 · Partial fix · 11.0.8, 10.1.42 +1 CWE-288
Priority MEDIUM 45
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03768 · Published 2025-08-13 · Partial fix · 11.0.10, 10.1.44 +1 CWE-404
Priority MEDIUM 43
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02129 · Published 2025-07-10 · Partial fix · 11.0.9, 10.1.43 +1 CWE-400
Priority MEDIUM 43
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02198 · Published 2025-07-10 · Partial fix · 11.0.9, 10.1.43 +1 CWE-190
Priority MEDIUM 43
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02074 · Published 2025-07-10 · Partial fix · 9.0.107 CWE-362
THREATIST.IORead the docs