The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1058-1 advisory.

    Update to Tomcat 9.0.115:

    - CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack     (bsc#1243895).
    - CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a     JVM crash       (bsc#1246389).
    - CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2023-44487: Rapid reset attack (bsc#1216182).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:1058-1)

critical Nessus Plugin ID 303957

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.7 Aug 7, 2026, 5:10 PM CISA reference Plugin Feed: 202608071710
Version 1.6 Aug 7, 2026, 1:31 AM CISA reference CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C") Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202608070131
Version 1.5 Jun 26, 2026, 4:08 PM Plugin metadata Plugin Feed: 202606261608
Version 1.4 May 1, 2026, 7:22 AM IAVM reference Plugin Feed: 202605010722
Version 1.3 Mar 30, 2026, 12:37 PM CEA reference Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202603301237
Version 1.1 Mar 28, 2026, 12:01 PM New Plugin Feed: 202603281201