It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-965 advisory.

    Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP     priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A     large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

    This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from     11.0.0-M2 through 11.0.5. (CVE-2025-31650)

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. (CVE-2025-31651)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-965)

high Nessus Plugin ID 235893

Version 1.2

Version 1.1

Version 1.2 Jun 5, 2025, 4:30 PM IAVM reference Plugin Feed: 202506051630
Version 1.1 May 14, 2025, 9:15 AM New Plugin Feed: 202505140915