Most recent entries from all

ALSA-2025:23048 — Important: tomcat security update

Affected: AlmaLinux:8: tomcat, AlmaLinux:8: tomcat-admin-webapps, AlmaLinux:8: tomcat-docs-webapp, AlmaLinux:8: tomcat-el-3.0-api, AlmaLinux:8: tomcat-jsp-2.3-api, AlmaLinux:8: tomcat-lib, AlmaLinux:8: tomcat-servlet-4.0-api, AlmaLinux:8: tomcat-webapps

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-05707

BIT-tomcat-2025-31651 — Apache Tomcat: Bypass of rules in Rewrite Valve

Affected: Bitnami: tomcat

This issue affects Apache Tomcat: from 11.0.0 through 11.0.5, from 10.1.0 through 10.1.39, from 9.0.0 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

certfr-2025-avi-0352 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer un dén…

certfr-2025-avi-0352

CLEANSTART-2026-EV68545 — Security fix for CVE-2025-31651 applied in: tomcat10 10.1.53-r0

Affected: CleanStart: tomcat10

Security vulnerability affects the tomcat10 package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2025-10031

EUVD-2026-272938

fkie_cve-2025-31651

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

GHSA-ff77-26x5-69cr — Apache Tomcat Rewrite rule bypass

Affected: Maven: org.apache.tomcat:tomcat-catalina, Maven: org.apache.tomcat.embed:tomcat-embed-core

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6, which fix the issue.

NCSC-2026-0256 — Kwetsbaarheden verholpen in Oracle Communications

NCSC-2026-0256

OESA-2025-1484 — tomcat security update

Affected: openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP3: tomcat

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es):

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.(CVE-2025-31650)

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2025-31651)

openSUSE-SU-2025:15048-1 — tomcat-9.0.104-1.1 on GA media

tomcat-9.0.104-1.1 on GA media

RHSA-2025:19809 — Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.3 release and security update

tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service

SUSE-SU-2025:01882-1 — Security update for tomcat

Security update for tomcat

UBUNTU-CVE-2025-31651

Affected: Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:Pro:24.04:LTS: tomcat10

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

WID-SEC-W-2025-0895 — Apache Tomcat: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen, oder Sicherheitsvorkehrungen zu umgehen.