Vulnerability-Lookup

RHSA-2025:11335

Vulnerability from csaf_opensuse - Published: 2025-07-16 00:00 - Updated: 2026-10-11 11:35

Summary

security update for tomcat

Severity

Important

Notes

Title of the patch: security update for tomcat

Description of the patch: This security update provides a functional equivalent of RHSA-2025:11335. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2025:11335.

Patchnames: RHSA-2025:11335

CVE-2024-56337

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9.6 EMS:tomcat-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:tomcat-lib-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9.6 EMS:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:tomcat-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:tomcat-lib-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch	—	Vendor Fix

Threats

Impact important

CVE-2025-31650

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2024-56337

Threats

Impact important

References

11 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2024-56337/	self
https://www.suse.com/security/cve/CVE-2025-31650/	self
https://www.suse.com/security/cve/CVE-2024-56337	external
https://bugzilla.suse.com/1234663	external
https://bugzilla.suse.com/1236809	external
https://www.suse.com/security/cve/CVE-2025-31650	external
https://bugzilla.suse.com/1242008	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for tomcat",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2025:11335.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2025:11335.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2025:11335",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_11335.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2025:11335",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-July/001817.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2025:11335",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-July/001817.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-56337 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-56337/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-31650 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-31650/"
      }
    ],
    "title": "security update for tomcat",
    "tracking": {
      "current_release_date": "2026-10-11T11:35:31Z",
      "generator": {
        "date": "2025-07-16T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2025:11335",
      "initial_release_date": "2025-07-16T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-07-16T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:46:47Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-11T11:35:31Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:9.0.87-3.el9_6.1.noarch",
                "product": {
                  "name": "tomcat-1:9.0.87-3.el9_6.1.noarch",
                  "product_id": "tomcat-1:9.0.87-3.el9_6.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.87:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat@9.0.87-3.el9_6.1?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.87-3.el9_6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
                  "product_id": "tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.87:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-admin-webapps@9.0.87-3.el9_6.1?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.87-3.el9_6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
                  "product_id": "tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.87:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-docs-webapp@9.0.87-3.el9_6.1?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.87-3.el9_6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
                "product": {
                  "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
                  "product_id": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/tomcat-el-3.0-api@9.0.87-3.el9_6.1?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
                "product": {
                  "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
                  "product_id": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/tomcat-jsp-2.3-api@9.0.87-3.el9_6.1?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
                "product": {
                  "name": "tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
                  "product_id": "tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.87:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-lib@9.0.87-3.el9_6.1?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.87-3.el9_6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
                "product": {
                  "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
                  "product_id": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/tomcat-servlet-4.0-api@9.0.87-3.el9_6.1?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
                "product": {
                  "name": "tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
                  "product_id": "tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.87:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-webapps@9.0.87-3.el9_6.1?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.87-3.el9_6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9.6 EMS",
                "product": {
                  "name": "SUSE Liberty Linux 9.6 EMS",
                  "product_id": "SUSE Liberty Linux 9.6 EMS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:tomcat-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:tomcat-lib-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:tomcat-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:tomcat-lib-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-1:9.0.87-3.el9_6.1.noarch as component of SUSE Liberty Linux 9.6 EMS",
          "product_id": "SUSE Liberty Linux 9.6 EMS:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch"
        },
        "product_reference": "tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9.6 EMS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-56337",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-56337"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nThe mitigation for CVE-2024-50379 was incomplete.\n\nUsers running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation \nparameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:\n- running on Java 8 or Java 11: the system property  sun.io.useCanonCaches must be explicitly set to false (it defaults to true)\n- running on Java 17: the  system property sun.io.useCanonCaches, if set, must be set to false  (it defaults to false)\n- running on Java 21 onwards: no further configuration is required  (the system property and the problematic cache have been removed)\n\nTomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that  sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set  sun.io.useCanonCaches to false by default where it can.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9.6 EMS:tomcat-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-56337",
          "url": "https://www.suse.com/security/cve/CVE-2024-56337"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234663 for CVE-2024-56337",
          "url": "https://bugzilla.suse.com/1234663"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236809 for CVE-2024-56337",
          "url": "https://bugzilla.suse.com/1236809"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9.6 EMS:tomcat-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9.6 EMS:tomcat-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-56337"
    },
    {
      "cve": "CVE-2025-31650",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-31650"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9.6 EMS:tomcat-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9.6 EMS:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
          "SUSE Liberty Linux 9:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-31650",
          "url": "https://www.suse.com/security/cve/CVE-2025-31650"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1242008 for CVE-2025-31650",
          "url": "https://bugzilla.suse.com/1242008"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9.6 EMS:tomcat-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9.6 EMS:tomcat-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9.6 EMS:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-lib-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.87-3.el9_6.1.noarch",
            "SUSE Liberty Linux 9:tomcat-webapps-1:9.0.87-3.el9_6.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-31650"
    }
  ]
}

CVE-2024-56337 (GCVE-0-2024-56337)

Vulnerability from cvelistv5 – Published: 2024-12-20 15:28 – Updated: 2025-11-04 15:59

Title

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

Summary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-13 13:28 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1085 records in the last 180 days details

References

4 references

URL	Tags
https://www.cve.org/CVERecord?id=CVE-2024-50379	vdb-entry
https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym…	vendor-advisory
https://security.netapp.com/advisory/ntap-2025010…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.1 (semver) Affected: 10.1.0-M1 , ≤ 10.1.33 (semver) Affected: 9.0.0.M1 , ≤ 9.0.97 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Unknown: 3 , < 8.5.0 (semver) Unknown: 10.0.0-M1 , ≤ 10.0.27 (semver)

Credits

This vulnerability was first reported by Nacl, WHOAMI, Yemoli and Ruozhi. This vulnerability was independently reported with a very helpful PoC by dawu@knownsec 404 team and Sunflower@knownsec 404 team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56337",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-13T13:28:46.946742Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-04T15:59:21.843Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:49:06.683Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250103-0002/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.1",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.33",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.97",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "unknown",
              "version": "3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.0.27",
              "status": "unknown",
              "version": "10.0.0-M1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability was first reported by Nacl, WHOAMI, Yemoli and Ruozhi."
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability was independently reported with a very helpful PoC by dawu@knownsec 404 team and Sunflower@knownsec 404 team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTime-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThe mitigation for CVE-2024-50379 was incomplete.\u003c/p\u003e\u003cp\u003eUsers running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation \nparameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:\u003cbr\u003e- running on Java 8 or Java 11: the system property\u0026nbsp;sun.io.useCanonCaches must be explicitly set to false (it defaults to true)\u003cbr\u003e- running on Java 17: the\u0026nbsp;system property sun.io.useCanonCaches, if set, must be set to false\u0026nbsp;(it defaults to false)\u003cbr\u003e- running on Java 21 onwards: no further configuration is required\u0026nbsp;(the system property and the problematic cache have been removed)\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eTomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that\u0026nbsp;sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set\u0026nbsp;sun.io.useCanonCaches to false by default where it can.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nThe mitigation for CVE-2024-50379 was incomplete.\n\nUsers running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation \nparameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:\n- running on Java 8 or Java 11: the system property\u00a0sun.io.useCanonCaches must be explicitly set to false (it defaults to true)\n- running on Java 17: the\u00a0system property sun.io.useCanonCaches, if set, must be set to false\u00a0(it defaults to false)\n- running on Java 21 onwards: no further configuration is required\u00a0(the system property and the problematic cache have been removed)\n\nTomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that\u00a0sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set\u00a0sun.io.useCanonCaches to false by default where it can."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T11:52:37.455Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-50379"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-56337",
    "datePublished": "2024-12-20T15:28:54.738Z",
    "dateReserved": "2024-12-20T11:16:29.949Z",
    "dateUpdated": "2025-11-04T15:59:21.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-31650 (GCVE-0-2025-31650)

Vulnerability from cvelistv5 – Published: 2025-04-28 19:14 – Updated: 2025-11-03 19:53

Title

Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

Summary

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-06 20:07 UTC

CWE

CWE-459 - Incomplete Cleanup

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1085 records in the last 180 days details

References

3 references

URL	Tags
https://lists.apache.org/thread/j6zzk0y3yym9pzfzk…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/04/28/2
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 9.0.76 , ≤ 9.0.102 (semver) Affected: 10.1.10 , ≤ 10.1.39 (semver) Affected: 11.0.0-M2 , ≤ 11.0.5 (semver) Affected: 8.5.90 , ≤ 8.5.100 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:53:11.497Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/04/28/2"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-31650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-06T20:07:38.530859Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-06T20:07:50.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "9.0.102",
              "status": "affected",
              "version": "9.0.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.39",
              "status": "affected",
              "version": "10.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.0.5",
              "status": "affected",
              "version": "11.0.0-M2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.90",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459 Incomplete Cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T11:43:00.251Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-31650",
    "datePublished": "2025-04-28T19:14:31.107Z",
    "dateReserved": "2025-03-31T12:13:57.705Z",
    "dateUpdated": "2025-11-03T19:53:11.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:11335

CVE-2024-56337 (GCVE-0-2024-56337)

CVE-2025-31650 (GCVE-0-2025-31650)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour