This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache Tomcat fixes 3 vulnerabilities
Apache fixes 3 vulnerabilities in Apache Tomcat in versions 11.0.8, 10.1.42 and 9.0.106 [1][2][3]. The fix is not yet available for any stable release of the popular Linux distributions [4][5][6][7][8][9]. Gentoo has fixed versions available as testing [10].
An unauthenticated remote attacker can carry out a DoS attack by sending specially crafted requests [3].
The vulnerability is present in product:
- Apache Tomcat; >=11.0.0-M1, <11.0.7; >=10.1.0-M1, <10.1.41; >=9.0.0.M1, <9.0.105;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-48988 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 16. 6. 2025.
An unauthenticated local attacker can execute arbitrary code by means of a side-loading attack during the installation of Apache Tomcat on Windows [2].
The vulnerability is present in product:
- Apache Tomcat; >=11.0.0-M1, <11.0.7; >=10.1.0, <10.1.41; >=9.0.23, <9.0.105;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-49124 at cve.org, NVD
- CWE-426: Untrusted Search Path at cwe.mitre.org
The vulnerability was publicly disclosed 16. 6. 2025.
An unauthenticated remote attacker can bypass a security constraint when accessing certain resources by means of a specially crafted link. The vulnerability can be exploited only if PreResources/PostResources are mounted outside the web application root [1].
The vulnerability is present in product:
- Apache Tomcat; >=11.0.0-M1, <11.0.7; >=10.1.0-M1, <10.1.41; >=9.0.0.M1, <9.0.105;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-49125 at cve.org, NVD
- CWE-288: Authentication Bypass Using an Alternate Path or Channel at cwe.mitre.org
The vulnerability was publicly disclosed 16. 6. 2025.
Links
- [1] https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk
- [2] https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
- [3] https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18
- [4] https://security-tracker.debian.org/tracker/CVE-2025-48988
- [5] https://security-tracker.debian.org/tracker/CVE-2025-49125
- [6] https://access.redhat.com/security/cve/cve-2025-48988
- [7] https://access.redhat.com/security/cve/cve-2025-49125
- [8] https://ubuntu.com/security/CVE-2025-48988
- [9] https://ubuntu.com/security/CVE-2025-49125
- [10] https://packages.gentoo.org/packages/www-servers/tomcat
By CESNET, z.s.p.o. Martin Krajči on 19. 6. 2025.