Red Hat Security AdvisoryRHSA-2025:7497
tomcat security update
Released 2025-05-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) tomcat-1:10.1.36-1.el10_0, tomcat-admin-webapps-1:10.1.36-1.el10_0, tomcat-docs-webapp-1:10.1.36-1.el10_0 +5
Fixes 11 records
Priority CRITICAL 100KEV
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.99942 · Published 2025-03-10 · Partial fix · 11.0.3, 10.1.35 +1 CWE-44
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority MEDIUM 60
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08969 · Published 2024-12-20 · Partial fix · 11.0.2, 10.1.34 +1 CWE-367
Priority MEDIUM 58
Unchecked Error Condition vulnerability in Apache Tomcat.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06246 · Published 2024-11-18 · Partial fix · 9.0.96, 10.1.30 +1 CWE-391
Priority MEDIUM 53
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.23072 · Published 2024-03-13 · Partial fix · 11.0.0-M17, 10.1.19 +2 CWE-20
Priority MEDIUM 44
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP t…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02651 · Published 2023-11-28 · Partial fix · 11.0.0-M11, 10.1.16 +2 CWE-444
Priority LOW 39
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP t…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.05883 · Published 2023-10-10 · Partial fix · 11.0.0-M12, 10.1.14 +2 CWE-20
Priority LOW 37
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.06459 · Published 2023-08-25 · Partial fix · 11.0.0-M11, 10.1.13 +2 CWE-601
Priority LOW 35
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 th…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02515 · Published 2023-10-10 · Partial fix · 11.0.0-M12, 10.1.14 +2 CWE-459
Priority LOW 34
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01939 · Published 2024-12-17 · Partial fix · 11.0.2, 10.1.34 +1 CWE-400
Priority LOW 33
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.02313 · Published 2024-03-13 · Partial fix · 11.0.0-M17, 10.1.19 +2 CWE-459
THREATIST.IORead the docs