CVE-2025-49124
Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Record
CVE-2025-49124- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
EUVDEUVD-2025-18410
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Record
EUVD-2025-18410- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-42wg-hm62-jcwg
Apache Tomcat installer for Windows has an untrusted search path vulnerability
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Record
GHSA-42wg-hm62-jcwg- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-426
- Updated
- 2026-11-02
NVD
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Record
CVE-2025-49124- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
OSV
Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Record
CVE-2025-49124- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
OSVGHSA-42wg-hm62-jcwg
Apache Tomcat installer for Windows has an untrusted search path vulnerability
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Record
GHSA-42wg-hm62-jcwg- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-426
- Updated
- 2026-11-02
Show 14 moreShow less
OSVROOT-APP-MAVEN-CVE-2025-49124
CVE-2025-49124 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root
Root has patched CVE-2025-49124 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-49124- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-49124
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Record
UBUNTU-CVE-2025-49124- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-tomcat-2025-49124 No score
Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
- Record
BIT-tomcat-2025-49124- Updated
- 2026-11-02
OSVCLSA-2025-1756253007 No score
TuxCare security update for 5 packages (18 CVEs)
TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.
- Record
CLSA-2025-1756253007- Updated
- 2026-11-02
OSVCLSA-2025-1759795579 No score
TuxCare security update for 6 packages (18 CVEs)
TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.
- Record
CLSA-2025-1759795579- Updated
- 2026-11-02
OSVCLSA-2025-1763338014 No score
TuxCare security update for 4 packages (10 CVEs)
TuxCare rebuilt 4 packages to address 10 CVEs. Fixed in 9.0.90-tuxcare.1.
- Record
CLSA-2025-1763338014- Updated
- 2026-11-02
OSVCLSA-2025-1764720465 No score
TuxCare security update for 5 packages (18 CVEs)
TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.
- Record
CLSA-2025-1764720465- Updated
- 2026-11-02
OSVCLSA-2025-1765411683 No score
TuxCare security update for 4 packages (15 CVEs)
TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.
- Record
CLSA-2025-1765411683- Updated
- 2026-11-02
OSVCLSA-2025-1766362095 No score
TuxCare security update for 4 packages (12 CVEs)
TuxCare rebuilt 4 packages to address 12 CVEs. Fixed in 9.0.100-tuxcare.1.
- Record
CLSA-2025-1766362095- Updated
- 2026-11-02
OSVCLSA-2026-1768262917 No score
TuxCare security update for 6 packages (22 CVEs)
TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.
- Record
CLSA-2026-1768262917- Updated
- 2026-11-02
OSVCLSA-2026-1773188120 No score
TuxCare security update for 5 packages (23 CVEs)
TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.
- Record
CLSA-2026-1773188120- Updated
- 2026-11-02
OSVCLSA-2026-1792575257 No score
TuxCare security update for 8 packages (32 CVEs)
TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.
- Record
CLSA-2026-1792575257- Updated
- 2026-11-02
OSVCLSA-2026-1793011037 No score
TuxCare security update for 5 packages (26 CVEs)
TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.
- Record
CLSA-2026-1793011037- Updated
- 2026-11-02
OSVCLSA-2026-1793727391 No score
TuxCare security update for 5 packages (8 CVEs)
TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.33-tuxcare.3.
- Record
CLSA-2026-1793727391- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-coreMaven |
11.0.0-M1 up to 11.0.8 | 11.0.8 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
10.1.0 up to 10.1.42 | 10.1.42 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
9.0.23 up to 9.0.106 | 9.0.106 |
org.apache.tomcat:tomcatMaven |
11.0.0-M1 up to 11.0.8 | 11.0.8 |
org.apache.tomcat:tomcatMaven |
10.1.0 up to 10.1.42 | 10.1.42 |
org.apache.tomcat:tomcatMaven |
9.0.23 up to 9.0.106 | 9.0.106 |
org.apache.tomcat:tomcat-catalinaMaven |
11.0.0-M1 up to 11.0.8 | 11.0.8 |
org.apache.tomcat:tomcat-catalinaMaven |
10.1.0 up to 10.1.42 | 10.1.42 |
org.apache.tomcat:tomcat-catalinaMaven |
9.0.23 up to 9.0.106 | 9.0.106 |
tomcatBitnami |
9.0.23 up to 9.0.107, 10.1.0 up to 10.1.42, 11.0.0 up to 11.0.9 | 9.0.10710.1.4211.0.9 |
Show 70 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 18 CVEs |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 18 CVEs |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 18 CVEs |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 18 CVEs |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat:tomcat-utilTuxCare:Maven From an advisory covering 18 CVEs |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 18 CVEs |
9.0.83 up to 9.0.83-tuxcare.1 | 9.0.83-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-websocketTuxCare:Maven From an advisory covering 18 CVEs |
9.0.83 up to 9.0.83-tuxcare.1 | 9.0.83-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 18 CVEs |
9.0.83 up to 9.0.83-tuxcare.1 | 9.0.83-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 18 CVEs |
9.0.83 up to 9.0.83-tuxcare.1 | 9.0.83-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 18 CVEs |
9.0.83 up to 9.0.83-tuxcare.1 | 9.0.83-tuxcare.1 |
org.apache.tomcat:tomcat-websocketTuxCare:Maven From an advisory covering 18 CVEs |
9.0.83 up to 9.0.83-tuxcare.1 | 9.0.83-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 10 CVEs |
9.0.90 up to 9.0.90-tuxcare.1 | 9.0.90-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 10 CVEs |
9.0.90 up to 9.0.90-tuxcare.1 | 9.0.90-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 10 CVEs |
9.0.90 up to 9.0.90-tuxcare.1 | 9.0.90-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 10 CVEs |
9.0.90 up to 9.0.90-tuxcare.1 | 9.0.90-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 18 CVEs |
9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1 |
9.0.50-tuxcare.2 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 18 CVEs |
9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1 |
9.0.50-tuxcare.2 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 18 CVEs |
9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1 |
9.0.50-tuxcare.2 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 18 CVEs |
9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1 |
9.0.50-tuxcare.2 |
org.apache.tomcat:tomcat-utilTuxCare:Maven From an advisory covering 18 CVEs |
9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1 |
9.0.50-tuxcare.2 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 15 CVEs |
9.0.87 up to 9.0.87-tuxcare.1 | 9.0.87-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 15 CVEs |
9.0.87 up to 9.0.87-tuxcare.1 | 9.0.87-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 15 CVEs |
9.0.87 up to 9.0.87-tuxcare.1 | 9.0.87-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 15 CVEs |
9.0.87 up to 9.0.87-tuxcare.1 | 9.0.87-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 12 CVEs |
9.0.100 up to 9.0.100-tuxcare.1 | 9.0.100-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 12 CVEs |
9.0.100 up to 9.0.100-tuxcare.1 | 9.0.100-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 12 CVEs |
9.0.100 up to 9.0.100-tuxcare.1 | 9.0.100-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 12 CVEs |
9.0.100 up to 9.0.100-tuxcare.1 | 9.0.100-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 22 CVEs |
10.1.18 up to 10.1.18-tuxcare.1 | 10.1.18-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-websocketTuxCare:Maven From an advisory covering 22 CVEs |
10.1.18 up to 10.1.18-tuxcare.1 | 10.1.18-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 22 CVEs |
10.1.18 up to 10.1.18-tuxcare.1 | 10.1.18-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 22 CVEs |
10.1.18 up to 10.1.18-tuxcare.1 | 10.1.18-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 22 CVEs |
10.1.18 up to 10.1.18-tuxcare.1 | 10.1.18-tuxcare.1 |
org.apache.tomcat:tomcat-websocketTuxCare:Maven From an advisory covering 22 CVEs |
10.1.18 up to 10.1.18-tuxcare.1 | 10.1.18-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 23 CVEs |
9.0.46 up to 9.0.46-tuxcare.1 | 9.0.46-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 23 CVEs |
9.0.46 up to 9.0.46-tuxcare.1 | 9.0.46-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 23 CVEs |
9.0.46 up to 9.0.46-tuxcare.1 | 9.0.46-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 23 CVEs |
9.0.46 up to 9.0.46-tuxcare.1 | 9.0.46-tuxcare.1 |
org.apache.tomcat:tomcat-utilTuxCare:Maven From an advisory covering 23 CVEs |
9.0.46 up to 9.0.46-tuxcare.1 | 9.0.46-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 32 CVEs |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-websocketTuxCare:Maven From an advisory covering 32 CVEs |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 32 CVEs |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 32 CVEs |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 32 CVEs |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-tribesTuxCare:Maven From an advisory covering 32 CVEs |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-utilTuxCare:Maven From an advisory covering 32 CVEs |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-websocketTuxCare:Maven From an advisory covering 32 CVEs |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 26 CVEs |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 26 CVEs |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 26 CVEs |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 26 CVEs |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat:tomcat-utilTuxCare:Maven From an advisory covering 26 CVEs |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven From an advisory covering 8 CVEs |
10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2 |
10.1.33-tuxcare.3 |
org.apache.tomcat:tomcatTuxCare:Maven From an advisory covering 8 CVEs |
10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2 |
10.1.33-tuxcare.3 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven From an advisory covering 8 CVEs |
10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2 |
10.1.33-tuxcare.3 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven From an advisory covering 8 CVEs |
10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2 |
10.1.33-tuxcare.3 |
org.apache.tomcat:tomcat-tribesTuxCare:Maven From an advisory covering 8 CVEs |
10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2 |
10.1.33-tuxcare.3 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
11.0.0-M1 up to 11.0.8, plus listed versions 11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13 Show 25 moreShow less11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.511.0.611.0.7 |
11.0.8 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
10.1.0 up to 10.1.42, plus listed versions 10.1.110.1.1010.1.1110.1.1210.1.13 Show 29 moreShow less10.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.510.1.610.1.710.1.810.1.9 |
10.1.42 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
9.0.23 up to 9.0.106, plus listed versions 9.0.1009.0.1029.0.1049.0.1059.0.24 Show 45 moreShow less9.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.409.0.419.0.439.0.449.0.459.0.469.0.489.0.509.0.529.0.539.0.549.0.559.0.569.0.589.0.599.0.609.0.629.0.639.0.649.0.659.0.679.0.689.0.699.0.709.0.719.0.729.0.739.0.749.0.759.0.769.0.789.0.799.0.80 |
9.0.106 |
org.apache.tomcat:tomcatMaven |
11.0.0-M1 up to 11.0.8, plus listed versions 11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13 Show 25 moreShow less11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.511.0.611.0.7 |
11.0.8 |
org.apache.tomcat:tomcatMaven |
10.1.0 up to 10.1.42, plus listed versions 10.1.110.1.1010.1.1110.1.1210.1.13 Show 29 moreShow less10.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.510.1.610.1.710.1.810.1.9 |
10.1.42 |
org.apache.tomcat:tomcatMaven |
9.0.23 up to 9.0.106, plus listed versions 9.0.1009.0.1029.0.1049.0.1059.0.24 Show 45 moreShow less9.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.409.0.419.0.439.0.449.0.459.0.469.0.489.0.509.0.529.0.539.0.549.0.559.0.569.0.589.0.599.0.609.0.629.0.639.0.649.0.659.0.679.0.689.0.699.0.709.0.719.0.729.0.739.0.749.0.759.0.769.0.789.0.799.0.80 |
9.0.106 |
org.apache.tomcat:tomcat-catalinaMaven |
11.0.0-M1 up to 11.0.8, plus listed versions 11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13 Show 25 moreShow less11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.511.0.611.0.7 |
11.0.8 |
org.apache.tomcat:tomcat-catalinaMaven |
10.1.0 up to 10.1.42, plus listed versions 10.1.110.1.1010.1.1110.1.1210.1.13 Show 29 moreShow less10.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.510.1.610.1.710.1.810.1.9 |
10.1.42 |
org.apache.tomcat:tomcat-catalinaMaven |
9.0.23 up to 9.0.106, plus listed versions 9.0.1009.0.1029.0.1049.0.1059.0.24 Show 45 moreShow less9.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.409.0.419.0.439.0.449.0.459.0.469.0.489.0.509.0.529.0.539.0.549.0.559.0.569.0.589.0.599.0.609.0.629.0.639.0.649.0.659.0.679.0.689.0.699.0.709.0.719.0.729.0.739.0.749.0.759.0.769.0.789.0.799.0.80 |
9.0.106 |
org.apache.tomcat.embed:tomcat-embed-coreRoot:Maven |
before 10.1.16-aikido.9 | 10.1.16-aikido.910.1.30-aikido.710.1.39-aikido.169.0.39-aikido.49.0.99-aikido.39.0.100-aikido.210.1.30-aikido.810.1.30-aikido.910.1.39-aikido.1710.1.34-aikido.510.1.39-aikido.1810.1.30-aikido.1010.1.34-aikido.69.0.100-aikido.39.0.39-aikido.59.0.63-aikido.29.0.99-aikido.410.1.39-aikido.1910.1.30-aikido.1110.1.30-aikido.1210.1.39-aikido.2010.1.30-aikido.1310.1.34-aikido.7 |
org.apache.tomcat:tomcat-catalinaRoot:Maven |
before 10.1.13-aikido.12 | 10.1.13-aikido.1211.0.8-aikido.3 |
io.root.org.apache.tomcat:tomcat-catalinaRoot:Maven |
before 10.1.13-root.io.6 | 10.1.13-root.io.610.1.13-root.io.710.1.13-root.io.810.1.13-root.io.910.1.13-root.io.1010.1.13-root.io.1110.1.13-root.io.1211.0.8-root.io.111.0.8-root.io.211.0.8-root.io.3 |
io.root.org.apache.tomcat.embed:tomcat-embed-coreRoot:Maven |
before 10.1.39-root.io.3 | 10.1.39-root.io.310.1.39-root.io.410.1.39-root.io.510.1.39-root.io.610.1.39-root.io.710.1.39-root.io.810.1.39-root.io.910.1.39-root.io.1010.1.39-root.io.1110.1.39-root.io.1210.1.34-root.io.110.1.34-root.io.210.1.39-root.io.1310.1.39-root.io.1410.1.16-root.io.510.1.30-root.io.310.1.16-root.io.610.1.30-root.io.410.1.16-root.io.710.1.39-root.io.1510.1.34-root.io.39.0.39-root.io.19.0.39-root.io.29.0.39-root.io.39.0.99-root.io.29.0.100-root.io.19.0.63-root.io.110.1.16-root.io.810.1.30-root.io.510.1.30-root.io.610.1.39-root.io.1810.1.16-root.io.910.1.30-root.io.710.1.39-root.io.169.0.39-root.io.49.0.99-root.io.39.0.100-root.io.210.1.30-root.io.810.1.30-root.io.910.1.39-root.io.1710.1.34-root.io.510.1.30-root.io.1010.1.34-root.io.69.0.100-root.io.39.0.39-root.io.59.0.63-root.io.29.0.99-root.io.410.1.39-root.io.1910.1.30-root.io.1110.1.30-root.io.1210.1.39-root.io.2010.1.30-root.io.1310.1.34-root.io.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49124 is a high vulnerability (CVSS 8.4) in Apache Tomcat, published June 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in org.apache.tomcat.embed:tomcat-embed-core 11.0.8.
References
lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
openwall.com/lists/oss-security/2025/06/16/3
nvd.nist.gov/vuln/detail/CVE-2025-49124
github.com/apache/tomcat/commit/28726cc2e63bed68771f5eb0f65a78dc7080571823
Show 8 moreShow less
tomcat.apache.org/security-10.html
ubuntu.com/security/CVE-2025-49124
cve.org/CVERecord?id=CVE-2025-49124
Left out here: 54 versions. The JSON record has them.