Every CVE Search/ Get API key

CVE-2025-53506

Apache Tomcat: DoS via excessive h2 streams at connection start

7.5 HighFix available

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.13%Up 2.1 points since Jul 11, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Apache Tomcat: DoS via excessive h2 streams at connection start

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
CVE-2025-53506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2025-21032 7.5

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
EUVD-2025-21032
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-25xr-qj8w-c4vf 7.5

Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
GHSA-25xr-qj8w-c4vf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.5

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
CVE-2025-53506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 7.5

Apache Tomcat: DoS via excessive h2 streams at connection start

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
CVE-2025-53506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2025-53506 7.5

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
DEBIAN-CVE-2025-53506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 45 moreShow less
OSVGHSA-25xr-qj8w-c4vf 7.5

Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
GHSA-25xr-qj8w-c4vf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVOESA-2025-1892 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1892
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1893 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1893
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1894 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1894
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1895 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1895
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1896 5.3

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1896
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1897 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

A vulnerability, which was classified as problematic, has been found in Apache Tomcat up to 9.0.105/10.1.41/11.0.7 (Application Server Software).Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 9.0.106, 10.1.42 or 11.0.8 eliminates this vulnerability.(CVE-2025-48988)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)

Record
OESA-2025-1897
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:11695 5.3

Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update

Record
RHSA-2025:11695
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:11741 5.3

Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update

Record
RHSA-2025:11741
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:14177 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14178 7.5

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2025:14178
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14179 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14179
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14180 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14180
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14181 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14181
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14182 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14182
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14183 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14177 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14178 7.5

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14178
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14179 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14179
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14181 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14181
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-53506 7.5

CVE-2025-53506 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2025-53506 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2025-53506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-53506 7.5

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
UBUNTU-CVE-2025-53506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:14177 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14177
Updated
2026-11-02
OSVALSA-2025:14178 No score

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14178
Updated
2026-11-02
OSVALSA-2025:14181 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14181
Updated
2026-11-02
OSVBIT-tomcat-2025-53506 No score

Apache Tomcat: DoS via excessive h2 streams at connection start

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.8, from 10.1.0 through 10.1.42, from 9.0.0 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Record
BIT-tomcat-2025-53506
Updated
2026-11-02
OSVCLSA-2025-1759795579 No score

TuxCare security update for 6 packages (18 CVEs)

TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.

Record
CLSA-2025-1759795579
Updated
2026-11-02
OSVCLSA-2025-1763338014 No score

TuxCare security update for 4 packages (10 CVEs)

TuxCare rebuilt 4 packages to address 10 CVEs. Fixed in 9.0.90-tuxcare.1.

Record
CLSA-2025-1763338014
Updated
2026-11-02
OSVCLSA-2025-1764720465 No score

TuxCare security update for 5 packages (18 CVEs)

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.

Record
CLSA-2025-1764720465
Updated
2026-11-02
OSVCLSA-2025-1765411683 No score

TuxCare security update for 4 packages (15 CVEs)

TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.

Record
CLSA-2025-1765411683
Updated
2026-11-02
OSVCLSA-2025-1765930090 No score

TuxCare security update for 6 packages (9 CVEs)

TuxCare rebuilt 6 packages to address 9 CVEs. Fixed in 9.0.75-tuxcare.2.

Record
CLSA-2025-1765930090
Updated
2026-11-02
OSVCLSA-2025-1766362095 No score

TuxCare security update for 4 packages (12 CVEs)

TuxCare rebuilt 4 packages to address 12 CVEs. Fixed in 9.0.100-tuxcare.1.

Record
CLSA-2025-1766362095
Updated
2026-11-02
OSVCLSA-2026-1768262917 No score

TuxCare security update for 6 packages (22 CVEs)

TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.

Record
CLSA-2026-1768262917
Updated
2026-11-02
OSVCLSA-2026-1770595754 No score

TuxCare security update for 3 packages (2 CVEs)

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 8.5.100-tuxcare.6.

Record
CLSA-2026-1770595754
Updated
2026-11-02
OSVCLSA-2026-1773188120 No score

TuxCare security update for 5 packages (23 CVEs)

TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.

Record
CLSA-2026-1773188120
Updated
2026-11-02
OSVCLSA-2026-1773706627 No score

TuxCare security update for 4 packages (6 CVEs)

TuxCare rebuilt 4 packages to address 6 CVEs. Fixed in 10.1.42-tuxcare.1.

Record
CLSA-2026-1773706627
Updated
2026-11-02
OSVCLSA-2026-1792575257 No score

TuxCare security update for 8 packages (32 CVEs)

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

Record
CLSA-2026-1792575257
Updated
2026-11-02
OSVCLSA-2026-1792666002 No score

TuxCare security update for 6 packages (17 CVEs)

TuxCare rebuilt 6 packages to address 17 CVEs. Fixed in 10.1.33-tuxcare.1.

Record
CLSA-2026-1792666002
Updated
2026-11-02
OSVCLSA-2026-1792667085 No score

TuxCare security update for 7 packages (24 CVEs)

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

Record
CLSA-2026-1792667085
Updated
2026-11-02
OSVCLSA-2026-1793011037 No score

TuxCare security update for 5 packages (26 CVEs)

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

Record
CLSA-2026-1793011037
Updated
2026-11-02
OSVCLSA-2026-1793011786 No score

TuxCare security update for 7 packages (22 CVEs)

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

Record
CLSA-2026-1793011786
Updated
2026-11-02
OSVMGASA-2025-0223 No score

Updated tomcat packages fix vulnerabilities

APR/Native Connector crash leading to DoS. (CVE-2025-52434) DoS via integer overflow in multipart file upload. (CVE-2025-52520) DoS via excessive h2 streams at connection start. (CVE-2025-53506) H2 DoS - Made You Reset. (CVE-2025-48989)

Record
MGASA-2025-0223
Updated
2026-11-02
OSVopenSUSE-SU-2025:15440-1 No score

tomcat-9.0.107-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.107-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15440-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15441-1 No score

tomcat10-10.1.43-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.43-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15441-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15442-1 No score

tomcat11-11.0.9-1.1 on GA media

These are all security issues fixed in the tomcat11-11.0.9-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15442-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat-coyote
Maven
 11.0.0-M1 up to 11.0.9
11.0.9
org.apache.tomcat:tomcat-coyote
Maven
 10.1.0-M1 up to 10.1.43
10.1.43
org.apache.tomcat:tomcat-coyote
Maven
 9.0.0.M1 up to 9.0.107
9.0.107
org.apache.tomcat:tomcat-coyote
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0.M1 up to 9.0.107
9.0.107
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.0-M1 up to 10.1.43
10.1.43
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M1 up to 11.0.9
11.0.9
tomcat
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-admin-webapps
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
Show 290 moreShow less
Affected packages
PackageAffectedFixed
tomcat-docs-webapp
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-el-3.0-api
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-jsp-2.3-api
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-lib
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-servlet-4.0-api
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-webapps
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat9
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-admin-webapps
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-docs-webapp
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-el-3.0-api
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-jsp-2.3-api
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-lib
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-servlet-4.0-api
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-webapps
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-admin-webapps
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-docs-webapp
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-el-3.0-api
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-jsp-2.3-api
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-lib
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-servlet-4.0-api
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-webapps
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat
Bitnami
 before 9.0.107, 10.0.0 up to 10.1.43, 11.0.0 up to 11.0.9
9.0.10710.1.4311.0.9
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.83 up to 9.0.83-tuxcare.1
9.0.83-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 10 CVEs
 9.0.90 up to 9.0.90-tuxcare.1
9.0.90-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 10 CVEs
 9.0.90 up to 9.0.90-tuxcare.1
9.0.90-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 10 CVEs
 9.0.90 up to 9.0.90-tuxcare.1
9.0.90-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 10 CVEs
 9.0.90 up to 9.0.90-tuxcare.1
9.0.90-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 18 CVEs
 9.0.50 up to 9.0.50-tuxcare.2, plus listed versions
9.0.50-tuxcare.1
9.0.50-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 15 CVEs
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 9 CVEs
 9.0.75 up to 9.0.75-tuxcare.2, plus listed versions
9.0.75-tuxcare.1
9.0.75-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 12 CVEs
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 12 CVEs
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 12 CVEs
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 12 CVEs
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 22 CVEs
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 2 CVEs
 8.5.100 up to 8.5.100-tuxcare.6, plus listed versions
8.5.100-tuxcare.38.5.100-tuxcare.48.5.100-tuxcare.58.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.6
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 2 CVEs
 8.5.100 up to 8.5.100-tuxcare.6, plus listed versions
8.5.100-tuxcare.38.5.100-tuxcare.48.5.100-tuxcare.58.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.6
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 2 CVEs
 8.5.100 up to 8.5.100-tuxcare.6, plus listed versions
8.5.100-tuxcare.38.5.100-tuxcare.48.5.100-tuxcare.58.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.6
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 23 CVEs
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 23 CVEs
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 23 CVEs
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 23 CVEs
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 23 CVEs
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 6 CVEs
 10.1.42 up to 10.1.42-tuxcare.1
10.1.42-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 6 CVEs
 10.1.42 up to 10.1.42-tuxcare.1
10.1.42-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 6 CVEs
 10.1.42 up to 10.1.42-tuxcare.1
10.1.42-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 6 CVEs
 10.1.42 up to 10.1.42-tuxcare.1
10.1.42-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-tribes
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 32 CVEs
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 17 CVEs
 10.1.33 up to 10.1.33-tuxcare.1
10.1.33-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 17 CVEs
 10.1.33 up to 10.1.33-tuxcare.1
10.1.33-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 17 CVEs
 10.1.33 up to 10.1.33-tuxcare.1
10.1.33-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 17 CVEs
 10.1.33 up to 10.1.33-tuxcare.1
10.1.33-tuxcare.1
org.apache.tomcat:tomcat-coyote-ffm
TuxCare:Maven
From an advisory covering 17 CVEs
 10.1.33 up to 10.1.33-tuxcare.1
10.1.33-tuxcare.1
org.apache.tomcat:tomcat-tribes
TuxCare:Maven
From an advisory covering 17 CVEs
 10.1.33 up to 10.1.33-tuxcare.1
10.1.33-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-tribes
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 24 CVEs
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 26 CVEs
 9.0.39 up to 9.0.39-tuxcare.2, plus listed versions
9.0.39-tuxcare.1
9.0.39-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat-util
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
From an advisory covering 22 CVEs
 9.0.13 up to 9.0.13-tuxcare.2, plus listed versions
9.0.13-tuxcare.1
9.0.13-tuxcare.2
tomcat10
Debian:12
 before 10.1.52-1~deb12u1, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 23 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.52-1~deb12u1
tomcat10
Debian:13
 before 10.1.52-1~deb13u1, plus listed versions
10.1.40-110.1.46-110.1.52-1~deb12u1
10.1.52-1~deb13u1
tomcat10
Debian:14
 before 10.1.46-1, plus listed versions
10.1.40-1
10.1.46-1
tomcat11
Debian:13
 before 11.0.15-1~deb13u1, plus listed versions
11.0.11-111.0.6-1
11.0.15-1~deb13u1
tomcat11
Debian:14
 before 11.0.11-1, plus listed versions
11.0.6-1
11.0.11-1
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:11
From an advisory covering 11 CVEs
 before 9.0.107-0+deb11u1, plus listed versions
9.0.43-19.0.43-29.0.43-2~deb11u19.0.43-2~deb11u109.0.43-2~deb11u11
Show 25 moreShow less
9.0.43-2~deb11u129.0.43-2~deb11u29.0.43-2~deb11u39.0.43-2~deb11u49.0.43-2~deb11u59.0.43-2~deb11u69.0.43-2~deb11u79.0.43-2~deb11u89.0.43-2~deb11u99.0.43-39.0.53-19.0.54-19.0.55-19.0.58-19.0.62-19.0.63-19.0.64-19.0.64-29.0.65-19.0.67-19.0.68-19.0.68-1.19.0.70-19.0.70-29.0.95-1
9.0.107-0+deb11u1
tomcat10
Debian:12
From an advisory covering 14 CVEs
 before 10.1.52-1~deb12u1, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 23 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.52-1~deb12u1
tomcat10
Debian:13
From an advisory covering 14 CVEs
 before 10.1.52-1~deb13u1, plus listed versions
10.1.40-110.1.46-110.1.52-1~deb12u1
10.1.52-1~deb13u1
tomcat11
Debian:13
From an advisory covering 13 CVEs
 before 11.0.15-1~deb13u1, plus listed versions
11.0.11-111.0.6-1
11.0.15-1~deb13u1
org.apache.tomcat:tomcat-coyote
Maven
 11.0.0-M1 up to 11.0.9, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 26 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.511.0.611.0.711.0.8
11.0.9
org.apache.tomcat:tomcat-coyote
Maven
 10.1.0-M1 up to 10.1.43, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 44 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.4210.1.510.1.610.1.710.1.810.1.9
10.1.43
org.apache.tomcat:tomcat-coyote
Maven
 9.0.0.M1 up to 9.0.107, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.1069.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.4
9.0.107
org.apache.tomcat:tomcat-coyote
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0.M1 up to 9.0.107, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.1069.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.4
9.0.107
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.0-M1 up to 10.1.43, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 44 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.4210.1.510.1.610.1.710.1.810.1.9
10.1.43
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M1 up to 11.0.9, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 26 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.511.0.611.0.711.0.8
11.0.9
tomcat
Mageia:9
From an advisory covering 4 CVEs
 before 9.0.108-1.mga9
9.0.108-1.mga9
tomcat
openEuler:20.03-LTS-SP4
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2003sp4
9.0.100-6.oe2003sp4
tomcat
openEuler:22.03-LTS-SP3
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2203sp3
9.0.100-6.oe2203sp3
tomcat
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2203sp4
9.0.100-6.oe2203sp4
tomcat
openEuler:24.03-LTS
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2403
9.0.100-6.oe2403
tomcat
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 9.0.100-6.oe2403sp1
9.0.100-6.oe2403sp1
tomcat
openEuler:24.03-LTS-SP2
From an advisory covering 4 CVEs
 before 9.0.100-6.oe2403sp2
9.0.100-6.oe2403sp2
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-java-jdk11
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-java-jdk8
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
From an advisory covering 6 CVEs
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el10
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el8
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el9
From an advisory covering 4 CVEs
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
tomcat
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-admin-webapps
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-docs-webapp
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-el-3.0-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-lib
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-webapps
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat9
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-admin-webapps
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-docs-webapp
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-el-3.0-api
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-jsp-2.3-api
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-lib
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-servlet-4.0-api
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-webapps
Red Hat:enterprise_linux:10.0
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-admin-webapps
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-docs-webapp
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-el-5.0-api
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-jsp-3.1-api
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-lib
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-servlet-6.0-api
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-webapps
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-admin-webapps
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-docs-webapp
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-el-3.0-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-lib
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-webapps
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-admin-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-docs-webapp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-el-3.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-lib
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-admin-webapps
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-docs-webapp
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-el-3.0-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-lib
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-webapps
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-admin-webapps
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat
Rocky Linux:8
From an advisory covering 7 CVEs
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat9
Rocky Linux:10
From an advisory covering 7 CVEs
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
Rocky Linux:10
From an advisory covering 6 CVEs
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat
Rocky Linux:9
From an advisory covering 7 CVEs
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.16-aikido.9
10.1.16-aikido.910.1.39-aikido.1610.1.30-aikido.810.1.30-aikido.910.1.16-aikido.1010.1.39-aikido.1710.1.34-aikido.510.1.39-aikido.1810.1.30-aikido.1010.1.34-aikido.69.0.74-aikido.210.1.16-aikido.1110.1.39-aikido.1910.1.30-aikido.1110.1.30-aikido.1210.1.16-aikido.1210.1.39-aikido.2010.1.30-aikido.1310.1.34-aikido.79.0.74-aikido.1
io.root.org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.39-root.io.10
10.1.39-root.io.1010.1.39-root.io.1110.1.39-root.io.1210.1.34-root.io.110.1.34-root.io.210.1.39-root.io.1310.1.39-root.io.1410.1.39-root.io.1510.1.34-root.io.310.1.16-root.io.810.1.39-root.io.1810.1.16-root.io.910.1.39-root.io.1610.1.30-root.io.810.1.30-root.io.910.1.16-root.io.1010.1.39-root.io.1710.1.34-root.io.510.1.30-root.io.1010.1.34-root.io.69.0.74-root.io.210.1.16-root.io.1110.1.39-root.io.1910.1.30-root.io.1110.1.30-root.io.1210.1.16-root.io.1210.1.39-root.io.2010.1.30-root.io.1310.1.34-root.io.79.0.74-root.io.1
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 2 CVEs
 before 9.0.36-3.148.1
9.0.36-3.148.1
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
From an advisory covering 3 CVEs
 before 10.1.43-150200.5.48.1
10.1.43-150200.5.48.1
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 3 CVEs
 before 10.1.43-150200.5.48.1
10.1.43-150200.5.48.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 3 CVEs
 before 10.1.43-150200.5.48.1
10.1.43-150200.5.48.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 10.1.43-150200.5.48.1
10.1.43-150200.5.48.1
tomcat10
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 10.1.43-150200.5.48.1
10.1.43-150200.5.48.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 3 CVEs
 before 10.1.43-150200.5.48.1
10.1.43-150200.5.48.1
tomcat10
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 10.1.43-150200.5.48.1
10.1.43-150200.5.48.1
tomcat11
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
From an advisory covering 3 CVEs
 before 11.0.9-150600.13.6.1
11.0.9-150600.13.6.1
tomcat11
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 3 CVEs
 before 11.0.9-150600.13.6.1
11.0.9-150600.13.6.1
tomcat11
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 11.0.9-150600.13.6.1
11.0.9-150600.13.6.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Manager Server LTS 4.3
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Enterprise Storage 7.1
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 9.0.108-150200.91.1
9.0.108-150200.91.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 43 CVEs
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 43 CVEs
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat8
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2
Show 11 moreShow less
8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6
 None known
tomcat9
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2
Show 6 moreShow less
9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8
 None known
tomcat9
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2
Show 10 moreShow less
9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3
 None known
tomcat9
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1
Show 9 moreShow less
9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4
 None known
tomcat10
Ubuntu:24.04:LTS
 All versions, plus listed versions
10.1.10-110.1.14-110.1.15-110.1.16-110.1.16-1ubuntu0.1~esm1
Show 4 moreShow less
10.1.16-1ubuntu0.1~esm210.1.16-1ubuntu0.1~esm310.1.16-1ubuntu0.1~esm410.1.55-1ubuntu2~24.04.1
 None known
tomcat10
Ubuntu:25.10
 All versions, plus listed versions
10.1.35-110.1.40-110.1.40-1ubuntu110.1.40-1ubuntu1.25.10.1
 None known
tomcat11
Ubuntu:25.10
 All versions, plus listed versions
11.0.6-1
 None known
tomcat10
Ubuntu:26.10
 All versions, plus listed versions
10.1.40-1ubuntu110.1.54-110.1.54-1ubuntu110.1.54-1ubuntu210.1.55-1ubuntu110.1.55-1ubuntu210.1.57~us1-0ubuntu1
 None known
tomcat10
Ubuntu:26.04:LTS
 All versions, plus listed versions
10.1.40-1ubuntu110.1.40-1ubuntu1.26.04.110.1.55-1ubuntu2~26.04.1
 None known
tomcat11
Ubuntu:26.04:LTS
 All versions, plus listed versions
11.0.6-111.0.11-111.0.15-111.0.18-111.0.18-1ubuntu0.1~esm111.0.22-2ubuntu2~26.04.1
 None known
tomcat
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 9.0.107-1.1
9.0.107-1.1
tomcat10
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 10.1.43-1.1
10.1.43-1.1
tomcat11
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 11.0.9-1.1
11.0.9-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53506 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published July 10, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in org.apache.tomcat:tomcat-coyote 11.0.9.

References

Show 143 moreShow less
This page doesn't list everything

Left out here: 14 package rows and 176 versions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 5 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open