Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

The version of tomcat installed on the remote host is prior to 9.0.108-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2025-022 advisory.

    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made     you reset attack.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from     9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

    Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
    (CVE-2025-48989)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.108, 10.1.0-M1 prior to 10.1.44 or 11.0.0-M1 prior to 11.0.10. It is, therefore, affected by a denial of service vulnerability due to Tomcat's HTTP/2 implementation vulnerable to the made you reset attack.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made     you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through     10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended     to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue. (CVE-2025-48989)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03024-1 advisory.

    Updated to 9.0.108:

    - CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart     upload (bsc#1246388)
    - CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318)
    - CVE-2025-52434: Fixed race condition on connection close when using the APR/Native connector leading to     a JVM crash (bsc#1246389)
    - CVE-2025-48989: Fixed 'MadeYouReset' DoS in HTTP/2 due to client triggered stream reset (bsc#1243895)

    Other:

    - Correct a regression in the fix for CVE-2025-49125 that       prevented access to PreResources and PostResources when mounted below the       web application root with a path that was terminated with a file       separator.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03006-1 advisory.

    Updated to Tomcat 10.1.44:

      - CVE-2025-48989: Fixed 'MadeYouReset' DoS in HTTP/2 due to client triggered stream reset (bsc#1243895)

    Other fixes:

      - Catalina
        - Fix: Fix bloom filter population for archive indexing when using a packed           WAR containing one or more JAR files. (markt)
      - Coyote
        - Fix: 69748: Add missing call to set keep-alive timeout when using           HTTP/1.1 following an async request, which was present for AJP.
          (remm/markt)
        - Fix: 69762: Fix possible overflow during HPACK decoding of integers. Note           that the maximum permitted value of an HPACK decoded integer is           Integer.MAX_VALUE. (markt)
        - Fix: Update the HTTP/2 overhead documentation - particularly the code           comments - to reflect the deprecation of the PRIORITY frame and clarify           that a stream reset always triggers an overhead increase. (markt)
        - Fix: 69762: Additional overflow fix for HPACK decoding of integers. Pull           request #880 by Chenjp. (markt)
      - Cluster
        - Update: Add enableStatistics configuration attribute for the           DeltaManager, defaulting to true. (remm)
      - WebSocket
        - Fix: Align the WebSocket extension handling for WebSocket client           connections with WebSocket server connections. The WebSocket client now           only includes an extension requested by an endpoint in the opening           handshake if the WebSocket client supports that extension. (markt)
      - Web applications
        - Fix: Manager and Host Manager. Provide the Manager and Host Manager web           applications with a dedicated favicon file rather than using the one from           the ROOT web application which might not be present or may represent           something entirely different. Pull requests #876 and #878 by Simon Arame.
      - Other
        - Update: Update Checkstyle to 10.26.1. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02992-1 advisory.

    Updated to Tomcat 11.0.10
    - CVE-2025-48989: Fixed 'MadeYouReset' DoS in HTTP/2 due to client triggered stream reset (bsc#1243895)

    Other fixes:
      * Catalina
        - Fix: Fix bloom filter population for archive indexing when using a           packed WAR containing one or more JAR files. (markt)
      * Coyote
        - Fix: 69748: Add missing call to set keep-alive timeout when using           HTTP/1.1 following an async request, which was present for AJP.
          (remm/markt)
        - Fix: 69762: Fix possible overflow during HPACK decoding of integers.
          Note that the maximum permitted value of an HPACK decoded integer is           Integer.MAX_VALUE. (markt)
        - Fix: Update the HTTP/2 overhead documentation - particularly the code           comments - to reflect the deprecation of the PRIORITY frame and           clarify that a stream reset always triggers an overhead increase.
          (markt)
      * Cluster
        - Update: Add enableStatistics configuration attribute for the           DeltaManager, defaulting to true. (remm)
      * WebSocket
        - Fix: Align the WebSocket extension handling for WebSocket client           connections with WebSocket server connections. The WebSocket client           now only includes an extension requested by an endpoint in the           opening handshake if the WebSocket client supports that extension.
          (markt)
      * Web applications
        - Fix: Manager and Host Manager. Provide the Manager and Host Manager           web applications with a dedicated favicon file rather than using the           one from the ROOT web application which might not be present or may           represent something entirely different. Pull requests #876 and #878           by Simon Arame.
      * Other
        - Update: Update Checkstyle to 10.26.1. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0142 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-48976:
    Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload.
    This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
    Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

    CVE-2025-48988:
    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.
    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions     may also be affected.
    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-48989:
    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made     you reset attack.
    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from     9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.
    Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

    CVE-2025-49125:
    Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using     PreResources or PostResources mounted other than at the root of the web application, it was possible to     access those resources via an unexpected path. That path was likely not to be protected by the same     security constraints as the expected path, allowing those security constraints to be bypassed.
    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.
    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions     may also be affected.
    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-52434:
    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client     initiated closes of HTTP/2 connections.
    This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.
    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions     may also be affected.
    Users are recommended to upgrade to version 9.0.107, which fixes the issue.

    CVE-2025-52520:
    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat     could lead to a DoS via bypassing of size limits.
    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.
    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions     may also be affected.
    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

    CVE-2025-53506:
    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge     the initial settings frame that reduces the maximum permitted concurrent streams.
    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.
    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 through 8.5.100.
    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:14181 advisory.

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
      * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
      * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
      * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52520)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52434)
      * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14179 advisory.

    - tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
    - tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
    - tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - tomcat: Apache Tomcat denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:14177 advisory.

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
      * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
      * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
      * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52520)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52434)
      * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14178 advisory.

    - Resolves:
      tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - Resolves:
      tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
    - Resolves:
      tomcat: Dos in multipart upload (CVE-2025-48988)
    - Resolves:
      tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - Resolves:
      tomcat: Denial of service (CVE-2025-52434)
    - Resolves:
      tomcat: Denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14181 advisory.

    - Resolves: RHEL-102200       tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - Resolves: RHEL-108491       tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
    - Resolves: RHEL-108499       tomcat: Dos in multipart upload (CVE-2025-48988)
    - Resolves: RHEL-108507       tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - Resolves: RHEL-108515       tomcat: Denial of service (CVE-2025-52434)
    - Resolves: RHEL-108531       tomcat: Denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14177 advisory.

    - Resolves: RHEL-102193       tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - Resolves: RHEL-108486       tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
    - Resolves: RHEL-108494       tomcat: Dos in multipart upload (CVE-2025-48988)
    - Resolves: RHEL-108502       tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - Resolves: RHEL-108510       tomcat: Denial of service (CVE-2025-52434)
    - Resolves: RHEL-108524       tomcat: Denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14183 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14180 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14177 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14179 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14182 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14178 advisory.

    Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet     and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the     best-of-breed developers from around the world.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14181 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13685 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster),     the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 6.1.2 serves as a replacement for Red Hat JBoss Web Server 6.1.1.
    This release includes bug fixes, enhancements and component upgrades, which are documented in the Release     Notes that are linked to in the References section.

    Security Fix(es):

    * jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-52520)
    * [Minor Incident] tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames [jws-6]     (CVE-2025-48989)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.10. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_11.0.10_security-11 advisory.

  - Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service     typically manifested as an OutOfMemoryError. (CVE-2025-48989)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.108. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.108_security-9 advisory.

  - Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service     typically manifested as an OutOfMemoryError. (CVE-2025-48989)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.44. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.44_security-10 advisory.

  - Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service     typically manifested as an OutOfMemoryError. (CVE-2025-48989)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
261440	Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2025-022 (ALASTOMCAT9-2025-022)	Nessus	Amazon Linux Local Security Checks	high
114953	Apache Tomcat 9.0.0-M1 < 9.0.108 Denial of Service	Web App Scanning	Component Vulnerability	high
114952	Apache Tomcat 10.1.0-M1 < 10.1.44 Denial of Service	Web App Scanning	Component Vulnerability	high
114951	Apache Tomcat 11.0.0-M1 < 11.0.10 Denial of Service	Web App Scanning	Component Vulnerability	high
260019	Linux Distros Unpatched Vulnerability : CVE-2025-48989	Nessus	Misc.	high
258135	SUSE SLES15 / openSUSE 15 Security Update : tomcat (SUSE-SU-2025:03024-1)	Nessus	SuSE Local Security Checks	high
258107	SUSE SLES15 / openSUSE 15 Security Update : tomcat10 (SUSE-SU-2025:03006-1)	Nessus	SuSE Local Security Checks	high
258057	SUSE SLES15 / openSUSE 15 Security Update : tomcat11 (SUSE-SU-2025:02992-1)	Nessus	SuSE Local Security Checks	high
255236	Alibaba Cloud Linux 3 : 0142: tomcat (ALINUX3-SA-2025:0142)	Nessus	Alibaba Cloud Linux Local Security Checks	high
253668	AlmaLinux 9 : tomcat (ALSA-2025:14181)	Nessus	Alma Linux Local Security Checks	high
253655	Oracle Linux 10 : tomcat (ELSA-2025-14179)	Nessus	Oracle Linux Local Security Checks	high
253518	AlmaLinux 8 : tomcat (ALSA-2025:14177)	Nessus	Alma Linux Local Security Checks	high
253513	Oracle Linux 10 : tomcat9 (ELSA-2025-14178)	Nessus	Oracle Linux Local Security Checks	high
253511	Oracle Linux 9 : tomcat (ELSA-2025-14181)	Nessus	Oracle Linux Local Security Checks	high
253064	Oracle Linux 8 : tomcat (ELSA-2025-14177)	Nessus	Oracle Linux Local Security Checks	high
253062	RHEL 9 : tomcat (RHSA-2025:14183)	Nessus	Red Hat Local Security Checks	high
253061	RHEL 9 : tomcat (RHSA-2025:14180)	Nessus	Red Hat Local Security Checks	high
253060	RHEL 8 : tomcat (RHSA-2025:14177)	Nessus	Red Hat Local Security Checks	high
253059	RHEL 10 : tomcat (RHSA-2025:14179)	Nessus	Red Hat Local Security Checks	high
253049	RHEL 8 : tomcat (RHSA-2025:14182)	Nessus	Red Hat Local Security Checks	high
253047	RHEL 10 : tomcat9 (RHSA-2025:14178)	Nessus	Red Hat Local Security Checks	high
253046	RHEL 9 : tomcat (RHSA-2025:14181)	Nessus	Red Hat Local Security Checks	high
249345	RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 6.1.2 (RHSA-2025:13685)	Nessus	Red Hat Local Security Checks	high
249236	Apache Tomcat 11.0.0.M1 < 11.0.10	Nessus	Web Servers	high
249235	Apache Tomcat 9.0.0.M1 < 9.0.108	Nessus	Web Servers	high
249230	Apache Tomcat 10.1.0.M1 < 10.1.44	Nessus	Web Servers	high

Detections

Analytics

CVE-2025-48989

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high