The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0622 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-52434:
    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client     initiated closes of HTTP/2 connections.

    This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 9.0.107, which fixes the issue.

    CVE-2025-53506:
    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat     could lead to a DoS via bypassing of size limits.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

    CVE-2025-52520:
    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge     the initial settings frame that reduces the maximum permitted concurrent streams.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:14177 advisory.

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
      * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
      * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
      * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52520)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52434)
      * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:14181 advisory.

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
      * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
      * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
      * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52520)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52434)
      * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14181 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14177 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14177 advisory.

    - Resolves: RHEL-102193       tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - Resolves: RHEL-108486       tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
    - Resolves: RHEL-108494       tomcat: Dos in multipart upload (CVE-2025-48988)
    - Resolves: RHEL-108502       tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - Resolves: RHEL-108510       tomcat: Denial of service (CVE-2025-52434)
    - Resolves: RHEL-108524       tomcat: Denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

ID	Name	Product	Family	Published	Updated	Severity
253486	TencentOS Server 4: tomcat (TSSA-2025:0622)	Nessus	Tencent Local Security Checks	8/21/2025	12/4/2025	high
253518	AlmaLinux 8 : tomcat (ALSA-2025:14177)	Nessus	Alma Linux Local Security Checks	8/21/2025	8/21/2025	high
253668	AlmaLinux 9 : tomcat (ALSA-2025:14181)	Nessus	Alma Linux Local Security Checks	8/22/2025	8/22/2025	high
253046	RHEL 9 : tomcat (RHSA-2025:14181)	Nessus	Red Hat Local Security Checks	8/20/2025	8/20/2025	high
253060	RHEL 8 : tomcat (RHSA-2025:14177)	Nessus	Red Hat Local Security Checks	8/20/2025	8/20/2025	high
253064	Oracle Linux 8 : tomcat (ELSA-2025-14177)	Nessus	Oracle Linux Local Security Checks	8/20/2025	1/21/2026	high
332306	Photon OS 5.0: Apache PHSA-2025-5.0-91-0565	Nessus	PhotonOS Local Security Checks	8/5/2026	8/5/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high