The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6120 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6120-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     February 05, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : tomcat10     CVE ID         : CVE-2025-46701 CVE-2025-48976 CVE-2025-48988 CVE-2025-48989                      CVE-2025-49125 CVE-2025-52520 CVE-2025-53506 CVE-2025-55668                      CVE-2025-55752 CVE-2025-55754 CVE-2025-61795 CVE-2025-31650                      CVE-2025-31651     Debian Bug     : 1106820 1108119 1108117 1111097 1108115 1109112 1109114 1111099 1119294


    Several security vulnerabilities have been found in Tomcat 10, a Java web     server and servlet engine. This update improves the handling of HTTP/2     connections and corrects various flaws which can lead to uncontrolled resource     consumption and a denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 10.1.52-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 10.1.52-1~deb13u1.

    We recommend that you upgrade your tomcat10 packages.

    For the detailed security status of tomcat10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat10

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dsa-6120 : libtomcat10-embed-java - security update

high Nessus Plugin ID 298164

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.5 Feb 8, 2026, 5:16 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602081716
Version 1.4 Feb 8, 2026, 8:18 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602080818
Version 1.3 Feb 7, 2026, 9:06 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602070906
Version 1.1 Feb 6, 2026, 8:56 AM New Plugin Feed: 202602060856