The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1058-1 advisory.

    Update to Tomcat 9.0.115:

    - CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack     (bsc#1243895).
    - CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a     JVM crash       (bsc#1246389).
    - CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2023-44487: Rapid reset attack (bsc#1216182).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 8.5.89-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-001 advisory.

    The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7,     9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that     the maxParameterCount could be reached using query string parameters and a request was       submitted     that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request     parts could be bypassed with the potential for a denial of service to occur. (CVE-2023-28709)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

ID	Name	Product	Family	Published	Updated	Severity
303957	SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:1058-1)	Nessus	SuSE Local Security Checks	3/27/2026	8/7/2026	critical
181959	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-001)	Nessus	Amazon Linux Local Security Checks	9/27/2023	12/11/2024	high
203611	Photon OS 5.0: Apache PHSA-2023-5.0-0030	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	high

Detections

Analytics

Plugins Search

critical

high

high