https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:22:53 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:11332 <p><strong>Affected:</strong> AlmaLinux:10: tomcat9, AlmaLinux:10: tomcat9-admin-webapps, AlmaLinux:10: tomcat9-docs-webapp, AlmaLinux:10: tomcat9-el-3.0-api, AlmaLinux:10: tomcat9-jsp-2.3-api, AlmaLinux:10: tomcat9-lib, AlmaLinux:10: tomcat9-servlet-4.0-api, AlmaLinux:10: tomcat9-webapps</p> <p>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.</p> <p>Security Fix(es):</p> <p>* tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337) * tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: tomcat9, AlmaLinux:10: tomcat9-admin-webapps, AlmaLinux:10: tomcat9-docs-webapp, AlmaLinux:10: tomcat9-el-3.0-api, AlmaLinux:10: tomcat9-jsp-2.3-api, AlmaLinux:10: tomcat9-lib, AlmaLinux:10: tomcat9-servlet-4.0-api, AlmaLinux:10: tomcat9-webapps</p> <p>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.</p> <p>Security Fix(es):</p> <p>* tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337) * tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:11332 https://cve.radiocsirt.org/vuln/bdu:2025-05708 bdu:2025-05708 https://cve.radiocsirt.org/vuln/bdu:2025-05708 https://cve.radiocsirt.org/vuln/bit-tomcat-2025-31650 <p><strong>Affected:</strong> Bitnami: tomcat</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.</p> <p>This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.</p> <p>Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.</p> <p><strong>Affected:</strong> Bitnami: tomcat</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.</p> <p>This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.</p> <p>Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.</p> https://cve.radiocsirt.org/vuln/bit-tomcat-2025-31650 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0352 certfr-2025-avi-0352 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0352 https://cve.radiocsirt.org/vuln/cleanstart-2026-jj28789 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: tomcat10</p> <p>Multiple security vulnerabilities affect the tomcat10 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: tomcat10</p> <p>Multiple security vulnerabilities affect the tomcat10 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-jj28789 https://cve.radiocsirt.org/vuln/euvd-2026-257903 EUVD-2026-257903 https://cve.radiocsirt.org/vuln/euvd-2026-257903 https://cve.radiocsirt.org/vuln/fkie_cve-2025-31650 <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.</p> <p>This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.</p> <p>Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.</p> <p>This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.</p> <p>Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-31650 https://cve.radiocsirt.org/vuln/ghsa-3p2h-wqq4-wf4h <p><strong>Affected:</strong> Maven: org.apache.tomcat:tomcat-coyote, Maven: org.apache.tomcat.embed:tomcat-embed-core</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.</p> <p>This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.</p> <p>Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.</p> <p><strong>Affected:</strong> Maven: org.apache.tomcat:tomcat-coyote, Maven: org.apache.tomcat.embed:tomcat-embed-core</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.</p> <p>This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100.</p> <p>Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-3p2h-wqq4-wf4h https://cve.radiocsirt.org/vuln/oesa-2025-1484 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP3: tomcat</p> <p>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es):</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.</p> <p>This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.</p> <p>Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.(CVE-2025-31650)</p> <p>Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.</p> <p>Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2025-31651)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP3: tomcat</p> <p>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es):</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.</p> <p>This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.</p> <p>Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.(CVE-2025-31650)</p> <p>Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.</p> <p>Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2025-31651)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1484 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15048-1 <p>tomcat-9.0.104-1.1 on GA media</p> <p>tomcat-9.0.104-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15048-1 https://cve.radiocsirt.org/vuln/ppsa-2026-001 <p>**PIT User Authentication Service is part of the operating mode selection and access permission system PITmode.** The PIT User Authentication Service is affected by multiple vulnerabilities in included third-party components.</p> <p>**PIT User Authentication Service is part of the operating mode selection and access permission system PITmode.** The PIT User Authentication Service is affected by multiple vulnerabilities in included third-party components.</p> https://cve.radiocsirt.org/vuln/ppsa-2026-001 https://cve.radiocsirt.org/vuln/rhsa-2025:11332 <p>tomcat: RCE due to TOCTOU issue in JSP compilation tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame</p> <p>tomcat: RCE due to TOCTOU issue in JSP compilation tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame</p> https://cve.radiocsirt.org/vuln/rhsa-2025:11332 https://cve.radiocsirt.org/vuln/suse-su-2025:1537-1 <p>Security update for tomcat10</p> <p>Security update for tomcat10</p> https://cve.radiocsirt.org/vuln/suse-su-2025:1537-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-31650 <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: tomcat10</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: tomcat10</p> <p>Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-31650 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0895 <p>Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen, oder Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen, oder Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0895