csaf_redhat - rhsa-2025:14181

rhsa-2025:14181

Vulnerability from csaf_redhat

Published

2025-08-20 15:41

Modified

2025-08-20 21:09

Summary

Red Hat Security Advisory: tomcat security update

Notes

Topic

An update for tomcat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988) * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125) * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976) * tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989) * tomcat: Apache Tomcat denial of service (CVE-2025-52520) * tomcat: Apache Tomcat denial of service (CVE-2025-52434) * tomcat: Apache Tomcat denial of service (CVE-2025-53506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for tomcat is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:14181",
        "url": "https://access.redhat.com/errata/RHSA-2025:14181"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2373015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015"
      },
      {
        "category": "external",
        "summary": "2373018",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018"
      },
      {
        "category": "external",
        "summary": "2373020",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020"
      },
      {
        "category": "external",
        "summary": "2373309",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309"
      },
      {
        "category": "external",
        "summary": "2379374",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374"
      },
      {
        "category": "external",
        "summary": "2379382",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382"
      },
      {
        "category": "external",
        "summary": "2379386",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14181.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update",
    "tracking": {
      "current_release_date": "2025-08-20T21:09:32+00:00",
      "generator": {
        "date": "2025-08-20T21:09:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.6"
        }
      },
      "id": "RHSA-2025:14181",
      "initial_release_date": "2025-08-20T15:41:15+00:00",
      "revision_history": [
        {
          "date": "2025-08-20T15:41:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-08-20T15:41:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-08-20T21:09:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.6.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:9.0.87-3.el9_6.3.src",
                "product": {
                  "name": "tomcat-1:9.0.87-3.el9_6.3.src",
                  "product_id": "tomcat-1:9.0.87-3.el9_6.3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@9.0.87-3.el9_6.3?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:9.0.87-3.el9_6.3.noarch",
                "product": {
                  "name": "tomcat-1:9.0.87-3.el9_6.3.noarch",
                  "product_id": "tomcat-1:9.0.87-3.el9_6.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
                  "product_id": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
                  "product_id": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
                "product": {
                  "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
                  "product_id": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
                "product": {
                  "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
                  "product_id": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
                "product": {
                  "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
                  "product_id": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
                "product": {
                  "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
                  "product_id": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch",
                "product": {
                  "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch",
                  "product_id": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-3.el9_6.3?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch"
        },
        "product_reference": "tomcat-1:9.0.87-3.el9_6.3.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:9.0.87-3.el9_6.3.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src"
        },
        "product_reference": "tomcat-1:9.0.87-3.el9_6.3.src",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch"
        },
        "product_reference": "tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch"
        },
        "product_reference": "tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch"
        },
        "product_reference": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch"
        },
        "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch"
        },
        "product_reference": "tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch"
        },
        "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
        },
        "product_reference": "tomcat-webapps-1:9.0.87-3.el9_6.3.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-48976",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-06-16T16:00:46.319735+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373020"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373020",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12",
          "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12"
        }
      ],
      "release_date": "2025-06-16T15:00:48.140000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-20T15:41:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14181"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers"
    },
    {
      "cve": "CVE-2025-48988",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-06-16T15:00:56.878149+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat DoS in multipart upload",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18",
          "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18"
        }
      ],
      "release_date": "2025-06-16T14:13:40.457000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-20T15:41:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14181"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat DoS in multipart upload"
    },
    {
      "cve": "CVE-2025-48989",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-06-18T08:15:11.266000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373309"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated with an Important severity. It is simple to exploit because it does not require authentication and could result in a Denial of Service (DoS). While some DoS flaws are classified as Moderate, \u201cMadeYouReset\u201d is Important because of the limited barriers (no specialized tooling or advanced scripting) to exploitation which directly impacts service availability. The vulnerability arises from an implementation weakness in HTTP/2 stream reset handling \u2014 malformed client requests can trigger server-side resets without incrementing abuse counters, allowing an attacker to bypass built-in request throttling and overhead limits. Since these resets consume CPU and memory resources and can be generated at scale over a single TCP/TLS connection, a remote attacker could exhaust server capacity quickly, impacting all legitimate clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48989"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373309",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373309"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48989",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48989"
        },
        {
          "category": "external",
          "summary": "https://kb.cert.org/vuls/id/767506",
          "url": "https://kb.cert.org/vuls/id/767506"
        }
      ],
      "release_date": "2025-08-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-20T15:41:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14181"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames"
    },
    {
      "cve": "CVE-2025-49125",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "discovery_date": "2025-06-16T15:01:10.747453+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373018"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373018",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk",
          "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk"
        }
      ],
      "release_date": "2025-06-16T14:18:09.610000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-20T15:41:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14181"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources"
    },
    {
      "cve": "CVE-2025-52434",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2025-07-10T20:01:51.277157+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379382"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379382",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030",
          "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030"
        }
      ],
      "release_date": "2025-07-10T19:03:47.225000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-20T15:41:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14181"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    },
    {
      "cve": "CVE-2025-52520",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2025-07-10T20:01:27.937417+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379374"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379374",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5",
          "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5"
        }
      ],
      "release_date": "2025-07-10T19:05:41.637000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-20T15:41:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14181"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    },
    {
      "cve": "CVE-2025-53506",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-07-10T20:02:08.548439+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379386"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
          "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379386",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0",
          "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0"
        }
      ],
      "release_date": "2025-07-10T19:14:23.249000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-20T15:41:15+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14181"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-1:9.0.87-3.el9_6.3.src",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-admin-webapps-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-lib-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.3.noarch",
            "AppStream-9.6.0.Z.MAIN.EUS:tomcat-webapps-1:9.0.87-3.el9_6.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    }
  ]
}

CVE-2025-52520 (GCVE-0-2025-52520)

Vulnerability from cvelistv5

Published

2025-07-10 19:05

Modified

2025-08-08 12:13

Severity ?

CWE

CWE-190 - Integer Overflow or Wraparound

Summary

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

References

►

URL

Tags

https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 11.0.0-M1 ≤ 11.0.8 Version: 10.1.0-M1 ≤ 10.1.42 Version: 9.0.0.M1 ≤ 9.0.106 Version: 8.5.0 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-52520",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-11T14:08:03.553602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-11T14:10:55.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.8",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.42",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.106",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "unknown",
              "version": "6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Saravana Kumar"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFor some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T12:13:57.665Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: DoS via integer overflow in multipart file upload",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-52520",
    "datePublished": "2025-07-10T19:05:41.637Z",
    "dateReserved": "2025-06-17T07:31:32.117Z",
    "dateUpdated": "2025-08-08T12:13:57.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-53506 (GCVE-0-2025-53506)

Vulnerability from cvelistv5

Published

2025-07-10 19:14

Modified

2025-08-08 12:14

Severity ?

CWE

CWE-400 - Uncontrolled Resource Consumption

Summary

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

References

►

URL

Tags

https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 11.0.0-M1 ≤ 11.0.8 Version: 10.1.0-M1 ≤ 10.1.42 Version: 9.0.0.M1 ≤ 9.0.106 Version: 8.5.0 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-53506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-11T13:46:01.043076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-11T13:49:02.483Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.8",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.42",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.106",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kanatoko"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100.\n\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T12:14:53.022Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: DoS via excessive h2 streams at connection start",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-53506",
    "datePublished": "2025-07-10T19:14:23.249Z",
    "dateReserved": "2025-07-01T14:22:04.137Z",
    "dateUpdated": "2025-08-08T12:14:53.022Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-48989 (GCVE-0-2025-48989)

Vulnerability from cvelistv5

Published

2025-08-13 12:11

Modified

2025-08-13 19:56

Severity ?

CWE

CWE-404 - Improper Resource Shutdown or Release

Summary

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

References

►

URL

Tags

https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 11.0.0-M1 ≤ 11.0.9 Version: 10.1.0-M1 ≤ 10.1.43 Version: 9.0.0.M1 ≤ 9.0.107

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-48989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-13T18:37:15.707400Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-13T19:56:35.999Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.9",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.43",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.107",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "unknown",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel of Tel Aviv University"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "CWE-404 Improper Resource Shutdown or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-13T12:11:26.124Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: h2 DoS - Made You Reset",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-48989",
    "datePublished": "2025-08-13T12:11:26.124Z",
    "dateReserved": "2025-05-29T15:25:37.243Z",
    "dateUpdated": "2025-08-13T19:56:35.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-48976 (GCVE-0-2025-48976)

Vulnerability from cvelistv5

Published

2025-06-16 15:00

Modified

2025-06-17 14:07

Severity ?

CWE

Allocation of resources with insufficient limits

Summary

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

References

►

URL

Tags

https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12

vendor-advisory

Impacted products

Vendor

Product

Version

►

Apache Software Foundation

Apache Commons FileUpload

Version: 1.0 ≤

Apache Software Foundation

Apache Commons FileUpload

Version: 2.0.0-M1 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-06-16T20:03:22.449Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/16/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-48976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-17T14:04:56.145891Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T14:07:34.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "commons-fileupload:commons-fileupload",
          "product": "Apache Commons FileUpload",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.6",
              "status": "affected",
              "version": "1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.commons:commons-fileupload2",
          "product": "Apache Commons FileUpload",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.0.0-M4",
              "status": "affected",
              "version": "2.0.0-M1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "TERASOLUNA Framework Security Team of NTT DATA Group Corporation"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Allocation of resources with insufficient limits",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-16T15:00:48.140Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-48976",
    "datePublished": "2025-06-16T15:00:48.140Z",
    "dateReserved": "2025-05-29T07:19:14.431Z",
    "dateUpdated": "2025-06-17T14:07:34.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-52434 (GCVE-0-2025-52434)

Vulnerability from cvelistv5

Published

2025-07-10 19:03

Modified

2025-08-08 12:10

Severity ?

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Summary

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

References

►

URL

Tags

https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 9.0.0.M1 ≤ 9.0.106 Version: 8.5.0 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-52434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-11T14:02:46.073154Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-11T14:04:04.250Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "9.0.106",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "unknown",
              "version": "5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nacl"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "12SqweR"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "WHOAMI"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "yyzmoon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eConcurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 9.0.107, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T12:10:07.868Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: APR/Native Connector crash leading to DoS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-52434",
    "datePublished": "2025-07-10T19:03:47.225Z",
    "dateReserved": "2025-06-16T07:00:46.986Z",
    "dateUpdated": "2025-08-08T12:10:07.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-48988 (GCVE-0-2025-48988)

Vulnerability from cvelistv5

Published

2025-06-16 14:13

Modified

2025-08-08 11:54

Severity ?

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

References

►

URL

Tags

https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 11.0.0-M1 ≤ 11.0.7 Version: 10.1.0-M1 ≤ 10.1.41 Version: 9.0.0.M1 ≤ 9.0.105 Version: 8.5.0 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-06-16T20:03:23.409Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/16/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-48988",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-17T18:20:54.922006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T18:21:45.236Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.7",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.41",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.105",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "unknown",
              "version": "6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "TERASOLUNA Framework Security Team of NTT DATA Group Corporation"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T11:54:32.098Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: FileUpload large number of parts with headers DoS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-48988",
    "datePublished": "2025-06-16T14:13:40.457Z",
    "dateReserved": "2025-05-29T15:24:32.685Z",
    "dateUpdated": "2025-08-08T11:54:32.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-49125 (GCVE-0-2025-49125)

Vulnerability from cvelistv5

Published

2025-06-16 14:18

Modified

2025-08-12 13:27

Severity ?

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

References

►

URL

Tags

https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 11.0.0-M1 ≤ 11.0.7 Version: 10.1.0-M1 ≤ 10.1.41 Version: 9.0.0.M1 ≤ 9.0.105 Version: 8.5.0 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-06-16T20:03:25.368Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/16/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-49125",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-17T14:06:30.854034Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T13:27:29.949Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.7",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.41",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.105",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "unknown",
              "version": "8.0.0.RC1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Greg K (https://github.com/gregk4sec)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.\u0026nbsp; When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.\u00a0 When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T12:05:47.930Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Security constraint bypass for pre/post-resources",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-49125",
    "datePublished": "2025-06-16T14:18:09.610Z",
    "dateReserved": "2025-06-02T09:08:38.126Z",
    "dateUpdated": "2025-08-12T13:27:29.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2025:14181

Vulnerability from csaf_redhat

CVE-2025-52520 (GCVE-0-2025-52520)

Vulnerability from cvelistv5

CVE-2025-53506 (GCVE-0-2025-53506)

Vulnerability from cvelistv5

CVE-2025-48989 (GCVE-0-2025-48989)

Vulnerability from cvelistv5

CVE-2025-48976 (GCVE-0-2025-48976)

Vulnerability from cvelistv5

CVE-2025-52434 (GCVE-0-2025-52434)

Vulnerability from cvelistv5

CVE-2025-48988 (GCVE-0-2025-48988)

Vulnerability from cvelistv5

CVE-2025-49125 (GCVE-0-2025-49125)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature