The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1058-1 advisory.

    Update to Tomcat 9.0.115:

    - CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack     (bsc#1243895).
    - CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a     JVM crash       (bsc#1246389).
    - CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2023-44487: Rapid reset attack (bsc#1216182).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:1058-1)

critical Nessus Plugin ID 303957

Version 1.6