Every CVE Search/ Get API key

CVE-2025-24813

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

9.8 CriticalIn KEVPublic exploitFix available

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.9%Up 99.9 points since Mar 11, 2025
90%50%10%1%

What each source reports

NVD Score used 9.8

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
CVE-2025-24813
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-44, CWE-502, CWE-706
Updated
2026-11-02
CVE List 10.0

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
CVE-2025-24813
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-44, CWE-502
Updated
2026-11-02
EUVDEUVD-2025-6498 10.0

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
EUVD-2025-6498
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-83qj-6fr2-vhqg 9.2

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
GHSA-83qj-6fr2-vhqg
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-44, CWE-502
Updated
2026-11-02
CISA KEV No score

Apache Tomcat Path Equivalence Vulnerability

Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.

Record
CVE-2025-24813
Weakness
CWE-44, CWE-502
Updated
2026-11-02
OSV 10.0

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
CVE-2025-24813
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-44, CWE-502
Updated
2026-11-02
Show 47 moreShow less
OSVDEBIAN-CVE-2025-24813 9.8

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
DEBIAN-CVE-2025-24813
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-83qj-6fr2-vhqg 9.2

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
GHSA-83qj-6fr2-vhqg
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-44, CWE-502
Updated
2026-11-02
OSVRHSA-2025:3454 8.6

Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.3 release and security update

Record
RHSA-2025:3454
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2025:3608 8.6

Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.0 release and security update

Record
RHSA-2025:3608
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2025:3645 8.6

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:3645
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2025:3646 8.6

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:3646
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2025:3647 8.6

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:3647
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2025:3683 8.6

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:3683
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2025:3684 8.6

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:3684
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2025:7494 8.6

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2025:7494
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2025:7497 8.6

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:7497
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRLSA-2025:3645 8.6

Moderate: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)

  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:3645
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRLSA-2025:3683 8.6

Moderate: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)

  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:3683
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRLSA-2025:7494 8.6

Moderate: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:7494
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVRLSA-2025:7497 8.6

Moderate: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)

  • tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)

  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:7497
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-24813 9.8

CVE-2025-24813 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2025-24813 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2025-24813
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-24813 10.0

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
UBUNTU-CVE-2025-24813
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2025:3645 No score

Moderate: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)
  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:3645
Updated
2026-11-02
OSVALSA-2025:3683 No score

Moderate: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)
  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:3683
Updated
2026-11-02
OSVALSA-2025:7494 No score

Moderate: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:7494
Updated
2026-11-02
OSVALSA-2025:7497 No score

Moderate: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)
  • tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)
  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:7497
Updated
2026-11-02
OSVBIT-tomcat-2025-24813 No score

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.2, from 10.1.0 through 10.1.34, from 9.0.0 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:

  • writes enabled for the default servlet (disabled by default)
  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
  • attacker knowledge of the names of security sensitive files being uploaded
  • the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default)
  • support for partial PUT (enabled by default)
  • application was using Tomcat's file based session persistence with the default storage location
  • application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Record
BIT-tomcat-2025-24813
Updated
2026-11-02
OSVCLSA-2025-1742577759 No score

Fix CVE(s): CVE-2025-24813

  • SECURITY UPDATE: path Equivalence leading to Remote Code Execution and/or Information disclosure in Apache Tomcat
    • debian/patches/CVE-2025-24813.patch: Enhance lifecycle of temporary files used by partial PUT
    • CVE-2025-24813
Record
CLSA-2025-1742577759
Updated
2026-11-02
OSVCLSA-2025-1742733084 No score

tomcat: Fix of CVE-2025-24813

  • CVE-2025-24813: Fix path equivalence vulnerability to prevent remote code execution and information disclosure in Default Servlet
Record
CLSA-2025-1742733084
Updated
2026-11-02
OSVCLSA-2025-1742737069 No score

Fix CVE(s): CVE-2025-24813

  • SECURITY UPDATE: path Equivalence Vulnerability
    • debian/patches/CVE-2025-24813.patch: enhance lifecycle of temporary files used by partial PUT to delete temporary file right after finishing request processing
    • CVE-2025-24813
Record
CLSA-2025-1742737069
Updated
2026-11-02
OSVCLSA-2025-1750752721 No score

Fix CVE(s): CVE-2025-24813

  • SECURITY UPDATE: Remote code execution
    • debian/patches/CVE-2025-24813.patch: Delete temporary file right after finishing request processing
    • CVE-2025-24813
Record
CLSA-2025-1750752721
Updated
2026-11-02
OSVCLSA-2025-1751500955 No score

TuxCare security update for 3 packages (10 CVEs)

TuxCare rebuilt 3 packages to address 10 CVEs. Fixed in 8.5.100.tuxcare.1.

Record
CLSA-2025-1751500955
Updated
2026-11-02
OSVCLSA-2025-1755272015 No score

tomcat: Fix of CVE-2025-24813

  • CVE-2025-24813: fix path equivalence vulnerability leading to remote code execution and information disclosure
Record
CLSA-2025-1755272015
Updated
2026-11-02
OSVCLSA-2025-1755513827 No score

tomcat6: Fix of CVE-2025-24813

  • CVE-2025-24813: enhance lifecycle of temporary files used by partial PUT
Record
CLSA-2025-1755513827
Updated
2026-11-02
OSVCLSA-2025-1755516017 No score

tomcat6: Fix of CVE-2025-24813

  • CVE-2025-24813: enhance lifecycle of temporary files used by partial PUT
Record
CLSA-2025-1755516017
Updated
2026-11-02
OSVCLSA-2025-1759795579 No score

TuxCare security update for 6 packages (18 CVEs)

TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.

Record
CLSA-2025-1759795579
Updated
2026-11-02
OSVCLSA-2025-1760712981 No score

Fix CVE(s): CVE-2025-24813

  • SECURITY UPDATE: path Equivalence leads to Remote Code Execution and/or Information disclosure
    • debian/patches/CVE-2025-24813.patch: Enhance lifecycle of temporary files used by partial PUT
    • CVE-2025-24813
Record
CLSA-2025-1760712981
Updated
2026-11-02
OSVCLSA-2025-1764720465 No score

TuxCare security update for 5 packages (18 CVEs)

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.

Record
CLSA-2025-1764720465
Updated
2026-11-02
OSVCLSA-2025-1765411683 No score

TuxCare security update for 4 packages (15 CVEs)

TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.

Record
CLSA-2025-1765411683
Updated
2026-11-02
OSVCLSA-2025-1765930090 No score

TuxCare security update for 6 packages (9 CVEs)

TuxCare rebuilt 6 packages to address 9 CVEs. Fixed in 9.0.75-tuxcare.2.

Record
CLSA-2025-1765930090
Updated
2026-11-02
OSVCLSA-2026-1768262917 No score

TuxCare security update for 6 packages (22 CVEs)

TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.

Record
CLSA-2026-1768262917
Updated
2026-11-02
OSVCLSA-2026-1770077338 No score

TuxCare security update for 3 packages (4 CVEs)

TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 9.0.90-tuxcare.2.

Record
CLSA-2026-1770077338
Updated
2026-11-02
OSVCLSA-2026-1773188120 No score

TuxCare security update for 5 packages (23 CVEs)

TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.

Record
CLSA-2026-1773188120
Updated
2026-11-02
OSVCLSA-2026-1787675020 No score

TuxCare security update for 3 packages (3 CVEs)

TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 7.0.70-tuxcare.1.

Record
CLSA-2026-1787675020
Updated
2026-11-02
OSVCLSA-2026-1792575257 No score

TuxCare security update for 8 packages (32 CVEs)

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

Record
CLSA-2026-1792575257
Updated
2026-11-02
OSVCLSA-2026-1792667085 No score

TuxCare security update for 7 packages (24 CVEs)

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

Record
CLSA-2026-1792667085
Updated
2026-11-02
OSVCLSA-2026-1793011037 No score

TuxCare security update for 5 packages (26 CVEs)

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

Record
CLSA-2026-1793011037
Updated
2026-11-02
OSVCLSA-2026-1793011786 No score

TuxCare security update for 7 packages (22 CVEs)

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

Record
CLSA-2026-1793011786
Updated
2026-11-02
OSVCLSA-2026-1793202343 No score

TuxCare security update for 3 packages (5 CVEs)

TuxCare rebuilt 3 packages to address 5 CVEs. Fixed in 10.1.33-tuxcare.2.

Record
CLSA-2026-1793202343
Updated
2026-11-02
OSVMGASA-2025-0105 No score

Updated tomcat packages fix security vulnerabilities

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2004-56337) Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue (CVE-2025-24813).

Record
MGASA-2025-0105
Updated
2026-11-02
OSVopenSUSE-SU-2025:14896-1 No score

tomcat-9.0.99-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.99-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14896-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14897-1 No score

tomcat10-10.1.35-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.35-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14897-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat-catalina
Maven
 11.0.0-M1 up to 11.0.3
11.0.3
org.apache.tomcat:tomcat-catalina
Maven
 10.1.0-M1 up to 10.1.35
10.1.35
org.apache.tomcat:tomcat-catalina
Maven
 9.0.0.M1 up to 9.0.99
9.0.99
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M1 up to 11.0.3
11.0.3
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.0-M1 up to 10.1.35
10.1.35
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0.M1 up to 9.0.99
9.0.99
org.apache.tomcat:tomcat-catalina
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100 None known
tomcat
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-admin-webapps
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
Show 290 moreShow less
Affected packages
PackageAffectedFixed
tomcat-docs-webapp
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-el-3.0-api
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-jsp-2.3-api
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-lib
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-servlet-4.0-api
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-webapps
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-admin-webapps
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-docs-webapp
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-el-3.0-api
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-jsp-2.3-api
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-lib
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-servlet-4.0-api
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-webapps
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat9
AlmaLinux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-admin-webapps
AlmaLinux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-docs-webapp
AlmaLinux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-el-3.0-api
AlmaLinux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-jsp-2.3-api
AlmaLinux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-lib
AlmaLinux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-servlet-4.0-api
AlmaLinux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-webapps
AlmaLinux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
tomcat-admin-webapps
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
tomcat-docs-webapp
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
tomcat-el-5.0-api
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
tomcat-jsp-3.1-api
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
tomcat-lib
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
tomcat-servlet-6.0-api
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
tomcat-webapps
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
tomcat
Bitnami
 before 9.0.99, 10.0.0 up to 10.1.35, 11.0.0 up to 11.0.3
9.0.9910.1.3511.0.3
libtomcat9-embed-java
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els12
9.0.16-3ubuntu0.18.04.2+tuxcare.els12
libtomcat9-java
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els12
9.0.16-3ubuntu0.18.04.2+tuxcare.els12
tomcat9
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els12
9.0.16-3ubuntu0.18.04.2+tuxcare.els12
tomcat9-admin
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els12
9.0.16-3ubuntu0.18.04.2+tuxcare.els12
tomcat9-common
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els12
9.0.16-3ubuntu0.18.04.2+tuxcare.els12
tomcat9-docs
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els12
9.0.16-3ubuntu0.18.04.2+tuxcare.els12
tomcat9-examples
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els12
9.0.16-3ubuntu0.18.04.2+tuxcare.els12
tomcat9-user
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els12
9.0.16-3ubuntu0.18.04.2+tuxcare.els12
tomcat
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els9
1:9.0.62-11.el9_2.3.tuxcare.els9
tomcat-admin-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els9
1:9.0.62-11.el9_2.3.tuxcare.els9
tomcat-docs-webapp
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els9
1:9.0.62-11.el9_2.3.tuxcare.els9
tomcat-el-3.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els9
1:9.0.62-11.el9_2.3.tuxcare.els9
tomcat-jsp-2.3-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els9
1:9.0.62-11.el9_2.3.tuxcare.els9
tomcat-lib
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els9
1:9.0.62-11.el9_2.3.tuxcare.els9
tomcat-servlet-4.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els9
1:9.0.62-11.el9_2.3.tuxcare.els9
tomcat-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els9
1:9.0.62-11.el9_2.3.tuxcare.els9
libtomcat9-embed-java
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.8+tuxcare.els1
9.0.31-1ubuntu0.8+tuxcare.els1
libtomcat9-java
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.8+tuxcare.els1
9.0.31-1ubuntu0.8+tuxcare.els1
tomcat9
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.8+tuxcare.els1
9.0.31-1ubuntu0.8+tuxcare.els1
tomcat9-admin
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.8+tuxcare.els1
9.0.31-1ubuntu0.8+tuxcare.els1
tomcat9-common
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.8+tuxcare.els1
9.0.31-1ubuntu0.8+tuxcare.els1
tomcat9-docs
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.8+tuxcare.els1
9.0.31-1ubuntu0.8+tuxcare.els1
tomcat9-examples
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.8+tuxcare.els1
9.0.31-1ubuntu0.8+tuxcare.els1
tomcat9-user
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.8+tuxcare.els1
9.0.31-1ubuntu0.8+tuxcare.els1
libtomcat8-embed-java
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els2
8.5.100-1ubuntu1~18.04.1+tuxcare.els2
libtomcat8-java
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els2
8.5.100-1ubuntu1~18.04.1+tuxcare.els2
tomcat8
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els2
8.5.100-1ubuntu1~18.04.1+tuxcare.els2
tomcat8-admin
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els2
8.5.100-1ubuntu1~18.04.1+tuxcare.els2
tomcat8-common
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els2
8.5.100-1ubuntu1~18.04.1+tuxcare.els2
tomcat8-docs
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els2
8.5.100-1ubuntu1~18.04.1+tuxcare.els2
tomcat8-examples
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els2
8.5.100-1ubuntu1~18.04.1+tuxcare.els2
tomcat8-user
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els2
8.5.100-1ubuntu1~18.04.1+tuxcare.els2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 10 CVEs
 8.5.100 up to 8.5.100.tuxcare.1
8.5.100.tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 10 CVEs
 8.5.100 up to 8.5.100.tuxcare.1
8.5.100.tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 10 CVEs
 8.5.100 up to 8.5.100.tuxcare.1
8.5.100.tuxcare.1
tomcat
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-admin-webapps
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-docs-webapp
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-el-2.2-api
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-javadoc
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-jsp-2.2-api
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-jsvc
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-lib
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-servlet-3.0-api
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat-webapps
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els3
7.0.76-16.el7_9.tuxcare.els3
tomcat6
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-admin-webapps
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-docs-webapp
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-el-2.1-api
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-javadoc
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-jsp-2.1-api
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-lib
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-servlet-2.5-api
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-webapps
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-admin-webapps
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-docs-webapp
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-el-2.1-api
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-javadoc
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-jsp-2.1-api
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-lib
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-servlet-2.5-api
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
tomcat6-webapps
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els1
6.0.24-115.el6_10.tuxcare.els1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
libtomcat9-embed-java
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els1
9.0.31-1~deb10u12+tuxcare.els1
libtomcat9-java
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els1
9.0.31-1~deb10u12+tuxcare.els1
tomcat9
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els1
9.0.31-1~deb10u12+tuxcare.els1
tomcat9-admin
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els1
9.0.31-1~deb10u12+tuxcare.els1
tomcat9-common
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els1
9.0.31-1~deb10u12+tuxcare.els1
tomcat9-docs
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els1
9.0.31-1~deb10u12+tuxcare.els1
tomcat9-examples
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els1
9.0.31-1~deb10u12+tuxcare.els1
tomcat9-user
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els1
9.0.31-1~deb10u12+tuxcare.els1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 4 CVEs
 9.0.90 up to 9.0.90-tuxcare.2, plus listed versions
9.0.90-tuxcare.1
9.0.90-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 4 CVEs
 9.0.90 up to 9.0.90-tuxcare.2, plus listed versions
9.0.90-tuxcare.1
9.0.90-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 4 CVEs
 9.0.90 up to 9.0.90-tuxcare.2, plus listed versions
9.0.90-tuxcare.1
9.0.90-tuxcare.2
tomcat10
Debian:12
 before 10.1.34-0+deb12u2, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 17 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.34-0+deb12u2
tomcat10
Debian:13
 before 10.1.35-1
10.1.35-1
tomcat10
Debian:14
 before 10.1.35-1
10.1.35-1
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:11
 before 9.0.43-2~deb11u12, plus listed versions
9.0.43-19.0.43-2~deb11u19.0.43-2~deb11u109.0.43-2~deb11u119.0.43-2~deb11u2
Show 7 moreShow less
9.0.43-2~deb11u39.0.43-2~deb11u49.0.43-2~deb11u59.0.43-2~deb11u69.0.43-2~deb11u79.0.43-2~deb11u89.0.43-2~deb11u9
9.0.43-2~deb11u12
org.apache.tomcat:tomcat-catalina
Maven
 11.0.0-M1 up to 11.0.3, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 20 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.2
11.0.3
org.apache.tomcat:tomcat-catalina
Maven
 10.1.0-M1 up to 10.1.35, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 38 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.410.1.510.1.610.1.710.1.810.1.9
10.1.35
org.apache.tomcat:tomcat-catalina
Maven
 9.0.0.M1 up to 9.0.99, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.409.0.419.0.439.0.449.0.45
9.0.99
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M1 up to 11.0.3, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 20 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.2
11.0.3
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.0-M1 up to 10.1.35, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 38 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.410.1.510.1.610.1.710.1.810.1.9
10.1.35
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0.M1 up to 9.0.99, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.409.0.419.0.439.0.449.0.45
9.0.99
org.apache.tomcat:tomcat-catalina
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
tomcat
Mageia:9
From an advisory covering 2 CVEs
 before 9.0.102-1.mga9
9.0.102-1.mga9
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-java-jdk11
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-java-jdk8
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-8.redhat_00008.1.el7jws
0:9.0.87-8.redhat_00008.1.el7jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-8.redhat_00008.1.el8jws
0:9.0.87-8.redhat_00008.1.el8jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-8.redhat_00008.1.el9jws
0:9.0.87-8.redhat_00008.1.el9jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el8jws
0:10.1.36-6.redhat_00007.1.el8jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:10.1.36-6.redhat_00007.1.el9jws
0:10.1.36-6.redhat_00007.1.el9jws
jws6-tomcat-jakartaee-migration
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:1.0.6-2.redhat_00003.1.el8jws
0:1.0.6-2.redhat_00003.1.el8jws
jws6-tomcat-native
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:1.3.1-1.redhat_1.el8jws
0:1.3.1-1.redhat_1.el8jws
jws6-tomcat-native-debuginfo
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 3 CVEs
 before 0:1.3.1-1.redhat_1.el8jws
0:1.3.1-1.redhat_1.el8jws
jws6-tomcat-jakartaee-migration
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:1.0.6-2.redhat_00003.1.el9jws
0:1.0.6-2.redhat_00003.1.el9jws
jws6-tomcat-native
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:1.3.1-1.redhat_1.el9jws
0:1.3.1-1.redhat_1.el9jws
jws6-tomcat-native-debuginfo
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 3 CVEs
 before 0:1.3.1-1.redhat_1.el9jws
0:1.3.1-1.redhat_1.el9jws
tomcat
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-admin-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-docs-webapp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-el-3.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-lib
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_2.3
1:9.0.87-1.el9_2.3
tomcat-admin-webapps
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_2.3
1:9.0.87-1.el9_2.3
tomcat-docs-webapp
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_2.3
1:9.0.87-1.el9_2.3
tomcat-el-3.0-api
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_2.3
1:9.0.87-1.el9_2.3
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_2.3
1:9.0.87-1.el9_2.3
tomcat-lib
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_2.3
1:9.0.87-1.el9_2.3
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_2.3
1:9.0.87-1.el9_2.3
tomcat-webapps
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_2.3
1:9.0.87-1.el9_2.3
tomcat
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_4.3
1:9.0.87-1.el9_4.3
tomcat-admin-webapps
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_4.3
1:9.0.87-1.el9_4.3
tomcat-docs-webapp
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_4.3
1:9.0.87-1.el9_4.3
tomcat-el-3.0-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_4.3
1:9.0.87-1.el9_4.3
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_4.3
1:9.0.87-1.el9_4.3
tomcat-lib
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_4.3
1:9.0.87-1.el9_4.3
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_4.3
1:9.0.87-1.el9_4.3
tomcat-webapps
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el9_4.3
1:9.0.87-1.el9_4.3
tomcat
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-admin-webapps
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-docs-webapp
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-el-3.0-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-lib
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat-webapps
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_8.4
1:9.0.87-1.el8_8.4
tomcat-admin-webapps
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_8.4
1:9.0.87-1.el8_8.4
tomcat-docs-webapp
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_8.4
1:9.0.87-1.el8_8.4
tomcat-el-3.0-api
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_8.4
1:9.0.87-1.el8_8.4
tomcat-jsp-2.3-api
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_8.4
1:9.0.87-1.el8_8.4
tomcat-lib
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_8.4
1:9.0.87-1.el8_8.4
tomcat-servlet-4.0-api
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_8.4
1:9.0.87-1.el8_8.4
tomcat-webapps
Red Hat:rhel_eus:8.8::appstream
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_8.4
1:9.0.87-1.el8_8.4
tomcat9
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-admin-webapps
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat9-docs-webapp
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat
Rocky Linux:9
From an advisory covering 2 CVEs
 before 1:9.0.87-2.el9_5.1
1:9.0.87-2.el9_5.1
tomcat
Rocky Linux:8
From an advisory covering 2 CVEs
 before 1:9.0.87-1.el8_10.3
1:9.0.87-1.el8_10.3
tomcat9
Rocky Linux:10
 before 1:9.0.87-5.el10_0
1:9.0.87-5.el10_0
tomcat
Rocky Linux:10
From an advisory covering 3 CVEs
 before 1:10.1.36-1.el10_0
1:10.1.36-1.el10_0
org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.16-aikido.9
10.1.16-aikido.910.1.16-aikido.1010.1.34-aikido.510.1.34-aikido.69.0.74-aikido.210.1.16-aikido.1110.1.16-aikido.1210.1.34-aikido.79.0.74-aikido.1
org.apache.tomcat:tomcat-catalina
Root:Maven
 before 10.1.13-aikido.12
10.1.13-aikido.12
io.root.org.apache.tomcat:tomcat-catalina
Root:Maven
 before 10.1.13-root.io.3
10.1.13-root.io.310.1.13-root.io.410.1.13-root.io.510.1.13-root.io.610.1.13-root.io.710.1.13-root.io.810.1.13-root.io.910.1.13-root.io.1010.1.13-root.io.1110.1.13-root.io.12
io.root.org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.34-root.io.1
10.1.34-root.io.110.1.34-root.io.210.1.16-root.io.210.1.16-root.io.310.1.16-root.io.410.1.16-root.io.510.1.16-root.io.610.1.16-root.io.710.1.34-root.io.310.1.16-root.io.810.1.16-root.io.910.1.16-root.io.1010.1.34-root.io.510.1.34-root.io.69.0.74-root.io.210.1.16-root.io.1110.1.16-root.io.1210.1.34-root.io.79.0.74-root.io.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 9.0.36-3.139.1
9.0.36-3.139.1
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 9.0.36-3.139.1
9.0.36-3.139.1
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
From an advisory covering 2 CVEs
 before 10.1.39-150200.5.36.1
10.1.39-150200.5.36.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 10.1.39-150200.5.36.1
10.1.39-150200.5.36.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 10.1.39-150200.5.36.1
10.1.39-150200.5.36.1
tomcat10
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 10.1.39-150200.5.36.1
10.1.39-150200.5.36.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 10.1.39-150200.5.36.1
10.1.39-150200.5.36.1
tomcat10
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 10.1.39-150200.5.36.1
10.1.39-150200.5.36.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Manager Server 4.3
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Enterprise Storage 7.1
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 9.0.102-150200.78.1
9.0.102-150200.78.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 43 CVEs
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 43 CVEs
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat9
Ubuntu:Pro:18.04:LTS
 before 9.0.16-3ubuntu0.18.04.2+esm6, plus listed versions
9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm29.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm5
9.0.16-3ubuntu0.18.04.2+esm6
tomcat9
Ubuntu:Pro:20.04:LTS
 before 9.0.31-1ubuntu0.9+esm1, plus listed versions
9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2
Show 7 moreShow less
9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.9
9.0.31-1ubuntu0.9+esm1
tomcat9
Ubuntu:Pro:22.04:LTS
 before 9.0.58-1ubuntu0.2+esm2, plus listed versions
9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1
Show 6 moreShow less
9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm1
9.0.58-1ubuntu0.2+esm2
tomcat10
Ubuntu:Pro:24.04:LTS
 before 10.1.16-1ubuntu0.1~esm1, plus listed versions
10.1.10-110.1.14-110.1.15-110.1.16-1
10.1.16-1ubuntu0.1~esm1
tomcat9
Ubuntu:Pro:24.04:LTS
 before 9.0.70-2ubuntu0.1+esm1, plus listed versions
9.0.70-1ubuntu19.0.70-29.0.70-2ubuntu0.1
9.0.70-2ubuntu0.1+esm1
tomcat9
Ubuntu:25.10
 before 9.0.70-2ubuntu2, plus listed versions
9.0.70-2ubuntu1.1
9.0.70-2ubuntu2
tomcat
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 9.0.99-1.1
9.0.99-1.1
tomcat10
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 10.1.35-1.1
10.1.35-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitTomcat Partial PUT Java Deserialization2025-03-10
PoC in GitHubiSee857/CVE-2025-24813-PoC2025-03-13
PoC in GitHubN0c1or/CVE-2025-24813_POC2025-03-14
PoC in GitHubabsholi7ly/POC-CVE-2025-248132025-03-14
PoC in GitHubgregk4sec/CVE-2025-248132025-03-14
PoC in GitHubqzy0x/cve-2025-24813_poc2025-03-14
PoC in GitHubcharis3306/CVE-2025-248132025-03-16
PoC in GitHubimbas007/CVE-2025-24813-apache-tomcat2025-03-17
PoC in GitHubmsadeghkarimi/CVE-2025-24813-Exploit2025-03-18
PoC in GitHubmichael-david-fry/Apache-Tomcat-Vulnerability-POC-CVE-2025-248132025-03-19
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubps-interactive/lab-cve-2025-248132025-03-19
PoC in GitHubn0n-zer0/Spring-Boot-Tomcat-CVE-2025-248132025-03-20
PoC in GitHubAlaatk/CVE-2025-24813-POC2025-03-21
PoC in GitHubtonyarris/CVE-2025-24813-PoC2025-03-22
PoC in GitHubu238/Tomcat-CVE_2025_248132025-03-24
PoC in GitHubAlperenY-cs/CVE-2025-248132025-03-28
PoC in GitHubmanjula-aw/CVE-2025-248132025-03-30
PoC in GitHubB1gN0Se/Tomcat-CVE-2025-248132025-03-31
PoC in GitHubAsaL1n/CVE-2025-248132025-04-05
PoC in GitHubMuhammadWaseem29/CVE-2025-248132025-04-05
PoC in GitHubLa3B0z/CVE-2025-24813-POC2025-04-06
Exploit-DBApache Tomcat 11.0.3 - Remote Code Execution2025-04-07
PoC in GitHubHeimd411/CVE-2025-24813-noPoC2025-04-07
PoC in GitHubhorsehacks/CVE-2025-24813-checker2025-04-07
PoC in GitHubNamelessSaint8/CVE-2025-24813-POC2025-04-09
PoC in GitHubFranconyu/Poc_for_CVE-2025-248132025-04-10
PoC in GitHubcchopin/CVE-Arsenal-Lab2025-04-10
NucleiApache Tomcat Path Equivalence - Remote Code Execution

History

History
RecordedChangedSources
affected
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-24813 is a critical vulnerability (CVSS 9.8) in Apache Tomcat, published March 10, 2025. CISA lists it as known to be exploited, since April 1, 2025. EUVD reports exploitation since April 1, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.9%, the 99th percentile. Fixed in org.apache.tomcat:tomcat-catalina 11.0.3.

References

Show 189 moreShow less
This page doesn't list everything

Left out here: 51 package rows and 164 versions. The JSON record has them. The full exploit list has 35 more links. Left out on purpose, here and in the API, to keep responses small: 6 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open