Every CVE Search/ Get API key

CVE-2025-52434

Apache Tomcat: APR/Native Connector crash leading to DoS

7.5 HighFix available

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.07%Up 2.1 points since Jul 11, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Apache Tomcat: APR/Native Connector crash leading to DoS

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
CVE-2025-52434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362
Updated
2026-11-02
EUVDEUVD-2025-21045 7.5

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
EUVD-2025-21045
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4j3c-42xv-3f84 6.3

Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
GHSA-4j3c-42xv-3f84
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362
Updated
2026-11-02
NVD 7.5

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
CVE-2025-52434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362
Updated
2026-11-02
OSV 7.5

Apache Tomcat: APR/Native Connector crash leading to DoS

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
CVE-2025-52434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362
Updated
2026-11-02
OSVDEBIAN-CVE-2025-52434 7.5

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
DEBIAN-CVE-2025-52434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 40 moreShow less
OSVGHSA-4j3c-42xv-3f84 6.3

Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
GHSA-4j3c-42xv-3f84
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362
Updated
2026-11-02
OSVOESA-2025-1892 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1892
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1893 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1893
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1894 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1894
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1895 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1895
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1896 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1896
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1897 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

A vulnerability, which was classified as problematic, has been found in Apache Tomcat up to 9.0.105/10.1.41/11.0.7 (Application Server Software).Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 9.0.106, 10.1.42 or 11.0.8 eliminates this vulnerability.(CVE-2025-48988)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1897
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:11695 5.3

Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update

Record
RHSA-2025:11695
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:14177 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14178 7.5

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2025:14178
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14180 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14180
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14181 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14181
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14182 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14182
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14183 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14177 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14178 7.5

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14178
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14181 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14181
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-52434 7.5

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
UBUNTU-CVE-2025-52434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:14177 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14177
Updated
2026-11-02
OSVALSA-2025:14178 No score

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14178
Updated
2026-11-02
OSVALSA-2025:14181 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14181
Updated
2026-11-02
OSVBIT-tomcat-2025-52434 No score

Apache Tomcat: APR/Native Connector crash leading to DoS

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.

Record
BIT-tomcat-2025-52434
Updated
2026-11-02
OSVCLSA-2025-1759795579 No score

TuxCare security update for 6 packages (18 CVEs)

TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.

Record
CLSA-2025-1759795579
Updated
2026-11-02
OSVCLSA-2025-1765411679 No score

TuxCare security update for 3 packages (2 CVEs)

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 8.5.100-tuxcare.4.

Record
CLSA-2025-1765411679
Updated
2026-11-02
OSVCLSA-2025-1765411683 No score

TuxCare security update for 4 packages (15 CVEs)

TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.

Record
CLSA-2025-1765411683
Updated
2026-11-02
OSVCLSA-2025-1765930090 No score

TuxCare security update for 6 packages (9 CVEs)

TuxCare rebuilt 6 packages to address 9 CVEs. Fixed in 9.0.75-tuxcare.2.

Record
CLSA-2025-1765930090
Updated
2026-11-02
OSVCLSA-2025-1766362095 No score

TuxCare security update for 4 packages (12 CVEs)

TuxCare rebuilt 4 packages to address 12 CVEs. Fixed in 9.0.100-tuxcare.1.

Record
CLSA-2025-1766362095
Updated
2026-11-02
OSVCLSA-2026-1771891820 No score

TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 9.0.50-tuxcare.5.

Record
CLSA-2026-1771891820
Updated
2026-11-02
OSVCLSA-2026-1771978232 No score

TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 9.0.90-tuxcare.3.

Record
CLSA-2026-1771978232
Updated
2026-11-02
OSVCLSA-2026-1779805268 No score

tomcat: Fix of CVE-2025-52434

  • CVE-2025-52434: fix race condition in APR/native connector that could cause JVM crash on connection close
Record
CLSA-2026-1779805268
Updated
2026-11-02
OSVCLSA-2026-1780274968 No score

TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 9.0.46-tuxcare.7.

Record
CLSA-2026-1780274968
Updated
2026-11-02
OSVCLSA-2026-1792575257 No score

TuxCare security update for 8 packages (32 CVEs)

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

Record
CLSA-2026-1792575257
Updated
2026-11-02
OSVCLSA-2026-1792667085 No score

TuxCare security update for 7 packages (24 CVEs)

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

Record
CLSA-2026-1792667085
Updated
2026-11-02
OSVCLSA-2026-1793009305 No score

TuxCare security update for 2 packages (2 CVEs)

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 8.5.78-tuxcare.2.

Record
CLSA-2026-1793009305
Updated
2026-11-02
OSVCLSA-2026-1793011037 No score

TuxCare security update for 5 packages (26 CVEs)

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

Record
CLSA-2026-1793011037
Updated
2026-11-02
OSVCLSA-2026-1793011786 No score

TuxCare security update for 7 packages (22 CVEs)

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

Record
CLSA-2026-1793011786
Updated
2026-11-02
OSVMGASA-2025-0223 No score

Updated tomcat packages fix vulnerabilities

APR/Native Connector crash leading to DoS. (CVE-2025-52434) DoS via integer overflow in multipart file upload. (CVE-2025-52520) DoS via excessive h2 streams at connection start. (CVE-2025-53506) H2 DoS - Made You Reset. (CVE-2025-48989)

Record
MGASA-2025-0223
Updated
2026-11-02
OSVopenSUSE-SU-2025:15440-1 No score

tomcat-9.0.107-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.107-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15440-1
Updated
2026-11-02
OSVSUSE-SU-2025:03024-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Updated to 9.0.108:

  • CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart upload (bsc#1246388)
  • CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318)
  • CVE-2025-52434: Fixed race condition on connection close when using the APR/Native connector leading to a JVM crash (bsc#1246389)
  • CVE-2025-48989: Fixed 'MadeYouReset' DoS in HTTP/2 due to client triggered stream reset (bsc#1243895)

Other:

  • Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator.
Record
SUSE-SU-2025:03024-1
Updated
2026-11-02
OSVSUSE-SU-2026:1058-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.115:

  • CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
  • CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
  • CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
  • CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
  • CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
  • CVE-2023-44487: Rapid reset attack (bsc#1216182).
Record
SUSE-SU-2026:1058-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat-coyote
Maven
 9.0.0.M1 up to 9.0.107
9.0.107
org.apache.tomcat:tomcat-coyote
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0.M1 up to 9.0.107
9.0.107
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100 None known
tomcat
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-admin-webapps
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-docs-webapp
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-el-3.0-api
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-jsp-2.3-api
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-lib
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
Show 215 moreShow less
Affected packages
PackageAffectedFixed
tomcat-servlet-4.0-api
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-webapps
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat9
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-admin-webapps
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-docs-webapp
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-el-3.0-api
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-jsp-2.3-api
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-lib
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-servlet-4.0-api
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-webapps
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-admin-webapps
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-docs-webapp
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-el-3.0-api
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-jsp-2.3-api
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-lib
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-servlet-4.0-api
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-webapps
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat
Bitnami
 9.0.0 up to 9.0.107
9.0.107
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 2 CVEs
 8.5.100 up to 8.5.100-tuxcare.4, plus listed versions
8.5.100-tuxcare.38.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.4
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 2 CVEs
 8.5.100 up to 8.5.100-tuxcare.4, plus listed versions
8.5.100-tuxcare.38.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.4
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 2 CVEs
 8.5.100 up to 8.5.100-tuxcare.4, plus listed versions
8.5.100-tuxcare.38.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.4
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 12 CVEs
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 12 CVEs
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 12 CVEs
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 12 CVEs
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.50 up to 9.0.50-tuxcare.5, plus listed versions
9.0.50-tuxcare.19.0.50-tuxcare.29.0.50-tuxcare.39.0.50-tuxcare.4
9.0.50-tuxcare.5
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.50 up to 9.0.50-tuxcare.5, plus listed versions
9.0.50-tuxcare.19.0.50-tuxcare.29.0.50-tuxcare.39.0.50-tuxcare.4
9.0.50-tuxcare.5
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.90 up to 9.0.90-tuxcare.3, plus listed versions
9.0.90-tuxcare.19.0.90-tuxcare.2
9.0.90-tuxcare.3
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.90 up to 9.0.90-tuxcare.3, plus listed versions
9.0.90-tuxcare.19.0.90-tuxcare.2
9.0.90-tuxcare.3
tomcat
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els2
1:9.0.62-12.el9_2.1.tuxcare.els2
tomcat-admin-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els2
1:9.0.62-12.el9_2.1.tuxcare.els2
tomcat-docs-webapp
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els2
1:9.0.62-12.el9_2.1.tuxcare.els2
tomcat-el-3.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els2
1:9.0.62-12.el9_2.1.tuxcare.els2
tomcat-jsp-2.3-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els2
1:9.0.62-12.el9_2.1.tuxcare.els2
tomcat-lib
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els2
1:9.0.62-12.el9_2.1.tuxcare.els2
tomcat-servlet-4.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els2
1:9.0.62-12.el9_2.1.tuxcare.els2
tomcat-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els2
1:9.0.62-12.el9_2.1.tuxcare.els2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.7, plus listed versions
9.0.46-tuxcare.19.0.46-tuxcare.29.0.46-tuxcare.39.0.46-tuxcare.49.0.46-tuxcare.59.0.46-tuxcare.6
9.0.46-tuxcare.7
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.7, plus listed versions
9.0.46-tuxcare.19.0.46-tuxcare.29.0.46-tuxcare.39.0.46-tuxcare.49.0.46-tuxcare.59.0.46-tuxcare.6
9.0.46-tuxcare.7
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-tribes
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-tribes
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 2 CVEs
 8.5.78 up to 8.5.78-tuxcare.2, plus listed versions
8.5.78-tuxcare.1
8.5.78-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 2 CVEs
 8.5.78 up to 8.5.78-tuxcare.2, plus listed versions
8.5.78-tuxcare.1
8.5.78-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:11
From an advisory covering 11 CVEs
 before 9.0.107-0+deb11u1, plus listed versions
9.0.43-19.0.43-29.0.43-2~deb11u19.0.43-2~deb11u109.0.43-2~deb11u11
Show 25 moreShow less
9.0.43-2~deb11u129.0.43-2~deb11u29.0.43-2~deb11u39.0.43-2~deb11u49.0.43-2~deb11u59.0.43-2~deb11u69.0.43-2~deb11u79.0.43-2~deb11u89.0.43-2~deb11u99.0.43-39.0.53-19.0.54-19.0.55-19.0.58-19.0.62-19.0.63-19.0.64-19.0.64-29.0.65-19.0.67-19.0.68-19.0.68-1.19.0.70-19.0.70-29.0.95-1
9.0.107-0+deb11u1
org.apache.tomcat:tomcat-coyote
Maven
 9.0.0.M1 up to 9.0.107, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.1069.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.4
9.0.107
org.apache.tomcat:tomcat-coyote
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0.M1 up to 9.0.107, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.1069.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.4
9.0.107
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
tomcat
Mageia:9
From an advisory covering 4 CVEs
 before 9.0.108-1.mga9
9.0.108-1.mga9
tomcat
openEuler:20.03-LTS-SP4
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2003sp4
9.0.100-6.oe2003sp4
tomcat
openEuler:22.03-LTS-SP3
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2203sp3
9.0.100-6.oe2203sp3
tomcat
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2203sp4
9.0.100-6.oe2203sp4
tomcat
openEuler:24.03-LTS
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2403
9.0.100-6.oe2403
tomcat
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2403sp1
9.0.100-6.oe2403sp1
tomcat
openEuler:24.03-LTS-SP2
From an advisory covering 4 CVEs
 before 9.0.100-6.oe2403sp2
9.0.100-6.oe2403sp2
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-java-jdk11
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-java-jdk8
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
tomcat
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-admin-webapps
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-docs-webapp
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-el-3.0-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-lib
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-webapps
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat9
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-admin-webapps
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-docs-webapp
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-el-3.0-api
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-jsp-2.3-api
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-lib
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-servlet-4.0-api
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-webapps
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-admin-webapps
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-docs-webapp
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-el-3.0-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-lib
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-webapps
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-admin-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-docs-webapp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-el-3.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-lib
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-admin-webapps
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-docs-webapp
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-el-3.0-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-lib
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-webapps
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-admin-webapps
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-docs-webapp
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-el-3.0-api
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-jsp-2.3-api
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-lib
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-servlet-4.0-api
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-webapps
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-admin-webapps
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-docs-webapp
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-el-3.0-api
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-lib
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-webapps
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat
Rocky Linux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat9
Rocky Linux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
Rocky Linux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Manager Server LTS 4.3
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Enterprise Storage 7.1
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 43 CVEs
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 43 CVEs
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat8
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1
Show 14 moreShow less
8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.48.0.32-1ubuntu1.58.0.32-1ubuntu1.68.0.32-1ubuntu1.78.0.32-1ubuntu1.88.0.32-1ubuntu1.98.0.32-1ubuntu1.108.0.32-1ubuntu1.118.0.32-1ubuntu1.138.0.32-1ubuntu1.13+esm18.0.32-1ubuntu1.13+esm2
 None known
tomcat8
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2
Show 11 moreShow less
8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6
 None known
tomcat9
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2
Show 6 moreShow less
9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8
 None known
tomcat9
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2
Show 10 moreShow less
9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3
 None known
tomcat9
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1
Show 9 moreShow less
9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4
 None known
tomcat
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 9.0.107-1.1
9.0.107-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-52434 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published July 10, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in org.apache.tomcat:tomcat-coyote 9.0.107.

References

Show 133 moreShow less
This page doesn't list everything

Left out here: 176 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open