When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1058-1 advisory.

    Update to Tomcat 9.0.115:

    - CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack     (bsc#1243895).
    - CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a     JVM crash       (bsc#1246389).
    - CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2023-44487: Rapid reset attack (bsc#1216182).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2812 advisory.

    When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

    Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache     Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and     from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading     to information leaking from the current request/response to the next. Users are recommended to upgrade to     version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
    (CVE-2023-42795)

    Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information     disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache     Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from     9.0.0.M1 through 9.0.98.

    If all of the following were true, a malicious user was able to view       security sensitive files and/or     inject content into those files:- writes enabled for the default servlet (disabled by default)- support     for partial PUT (enabled by default)- a target URL for security sensitive uploads that was a sub-directory     of a target URL for public uploads- attacker knowledge of the names of security sensitive files being     uploaded- the security sensitive files also being uploaded via partial PUT

    If all of the following were true, a malicious user was able to       perform remote code execution:-     writes enabled for the default servlet (disabled by default)- support for partial PUT (enabled by     default)- application was using Tomcat's file based session persistence with the default storage location-     application included a library that may be leveraged in a deserialization attack

    Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.98, which fixes the issue.

    More justification and the patch links are available for all versions here:[1]     https://tomcat.apache.org/security-11.html[2] https://tomcat.apache.org/security-10.html[3]     https://tomcat.apache.org/security-9.html (CVE-2025-24813)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions
    10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP
    source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API
    File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API
    (FindFirstFileW) in some circumstances. (CVE-2021-24122)

The version of tomcat installed on the remote host is prior to 8.5.60-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-010 advisory.

    While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on     an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely     lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak     between requests. (CVE-2020-17527)

    When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

  - The fix for CVE-2020-9484 was incomplete. When using     Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,     8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a     configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to     CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously     published mitigations for CVE-2020-9484 also apply to     this issue.(CVE-2021-25329)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 10.0.0.M10. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.0.0-m10_security-10 advisory.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on     an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely     lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak     between requests. (CVE-2020-17527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14705-1 advisory.

  - When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to     7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default     servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This     JSP could then be requested and any code it contained would be executed by the server. (CVE-2017-12617)

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to     9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to     this issue. (CVE-2021-25329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The fix for CVE-2020-9484 was incomplete. When using     Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,     8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a     configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to     CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously     published mitigations for CVE-2020-9484 also apply to     this issue.(CVE-2021-25329)

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 7.0.107. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.107_security-7 advisory.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

This update for tomcat fixes the following issues :

  - CVE-2021-24122: Fixed an information disclosure if     resources are served from the NTFS file system     (bsc#1180947).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0494 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster),     the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0,     and includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes,     linked to in the References.

    Security Fix(es):

    * tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)
    * tomcat: HTTP/2 request header mix-up (CVE-2020-17527)
    * tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)
    * openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

  - While investigating bug 64830 it was discovered that     Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request     header value from the previous stream received on an     HTTP/2 connection for the request associated with the     subsequent stream. While this would most likely lead to     an error and the closure of the HTTP/2 connection, it     is possible that information could leak between     requests.(CVE-2020-17527)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 or 7.0.0 to 7.0.106. It is, therefore, affected by a vulnerability. Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. Information could leak between requests.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.5.60. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.5.60_security-8 advisory.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on     an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely     lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak     between requests. (CVE-2020-17527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.40. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.40_security-9 advisory.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on     an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely     lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak     between requests. (CVE-2020-17527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
303957	SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:1058-1)	Nessus	SuSE Local Security Checks	Local	critical
247516	Linux Distros Unpatched Vulnerability : CVE-2021-24122	Nessus	Misc.	Local	medium
233710	Amazon Linux 2 : tomcat (ALAS-2025-2812)	Nessus	Amazon Linux Local Security Checks	Local	critical
409091	SCA: security update for org.apache.tomcat.embed:tomcat-embed-core (GHSA-2rvv-w9r2-rg7m)	Tenable Cloud Security	SCA Checks	Local	medium
409091	SCA: security update for org.apache.tomcat.embed:tomcat-embed-core (GHSA-2rvv-w9r2-rg7m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
182062	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-010)	Nessus	Amazon Linux Local Security Checks	Local	high
153352	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2021-2435)	Nessus	Huawei Local Security Checks	Local	high
150937	Apache Tomcat 10.0.0.M1 < 10.0.0.M10 multiple vulnerabilities	Nessus	Web Servers	Combined	high
150565	SUSE SLES11 Security Update : tomcat6 (SUSE-SU-2021:14705-1)	Nessus	SuSE Local Security Checks	Local	high
149630	EulerOS 2.0 SP5 : tomcat (EulerOS-SA-2021-1915)	Nessus	Huawei Local Security Checks	Local	high
149164	EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2021-1856)	Nessus	Huawei Local Security Checks	Local	high
148405	Apache Tomcat 7.0.0 < 7.0.107	Nessus	Web Servers	Combined	medium
148353	Photon OS 4.0: Apache PHSA-2021-4.0-0007	Nessus	PhotonOS Local Security Checks	Local	high
146852	openSUSE Security Update : tomcat (openSUSE-2021-330)	Nessus	SuSE Local Security Checks	Local	medium
146431	RHEL 7 / 8 : Red Hat JBoss Web Server 5.4.1 Security Update (Moderate) (RHSA-2021:0494)	Nessus	Red Hat Local Security Checks	Local	high
145727	EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2021-1175)	Nessus	Huawei Local Security Checks	Local	high
112676	Apache Tomcat 7.0.x < 7.0.107 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	high
144054	Apache Tomcat 8.5.0 < 8.5.60 multiple vulnerabilities	Nessus	Web Servers	Combined	high
144050	Apache Tomcat 9.0.0.M1 < 9.0.40 multiple vulnerabilities	Nessus	Web Servers	Combined	high
112669	Apache Tomcat 8.5.x < 8.5.60 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	high
112668	Apache Tomcat 9.0.0.M1 < 9.0.40 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	high
112667	Apache Tomcat 10.0.0-M1 < 10.0.0-M10 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2021-24122

medium

Tenable Plugins

critical

medium

critical

medium

medium

high

high

high

high

high

high

medium

high

medium

high

high

high

high

high

high

high

high