Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.6 - Apache Tomcat 10.1.0-M1 through 10.1.40 - Apache Tomcat 9.0.0.M1 through 9.0.104
Description:
Credit:
Greg K (https://github.com/gregk4sec) (finder)
References:
https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-46701
Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.5 - Apache Tomcat 10.1.0-M1 through 10.1.39 - Apache Tomcat 9.0.0.M1 through 9.0.102
Description: for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.
Credit:
COSCO Shipping Lines DIC (finder)
References:
https://lists.apache.org/list.html?announce () tomcat apache org https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-31651
Severity: important
Affected versions:
- Apache Tomcat 9.0.76 through 9.0.102 - Apache Tomcat 10.1.10 through 10.1.39 - Apache Tomcat 11.0.0-M2 through 11.0.5
Description:
References:
https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826 https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-31650
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update provides the corresponding updates for Apache Tomcat. Original advisory details: It was discovered that Apache Traffic Server exhibited poor server resource management in its HTTP/2 protocol. An attacker could possibly use this issue to cause Apache Traffic Server to crash, resulting in a denial of service.
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.2 - Apache Tomcat 10.1.0-M1 through 10.1.34 - Apache Tomcat 9.0.0.M1 through 9.0.98
Description:
- writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default)
Credit:
COSCO Shipping Lines DIC (finder) sw0rd1ight (https://github.com/sw0rd1ight) (finder)
References:
https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-24813
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.1 - Apache Tomcat 10.1.0-M1 through 10.1.33 - Apache Tomcat 9.0.0.M1 through 9.0.97
Description:
The mitigation for CVE-2024-50379 was incomplete. - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Credit: References:
https://www.cve.org/CVERecord?id=CVE-2024-50379 https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-56337
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.08 Should that last fixed version be 9.0.98 ?
Nick
On 17/12/2024 16:23, Agostino Sarubbo wrote: On martedì 17 dicembre 2024 13:46:54 CET Mark Thomas wrote:
> - Apache Tomcat 9.0.0.M1 through 9.9.97
I think this is 9.0.97 instead of 9.9.97 Yes, that is correct. I've submitted a correction to cve.org.
Kind regards,
Mark
On martedì 17 dicembre 2024 13:46:54 CET Mark Thomas wrote: - Apache Tomcat 9.0.0.M1 through 9.9.97 I think this is 9.0.97 instead of 9.9.97
Agostino
Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.1 - Apache Tomcat 10.1.0-M1 through 10.1.33 - Apache Tomcat 9.0.0.M1 through 9.9.97
Description:
References:
https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-54677
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.1 - Apache Tomcat 10.1.0-M1 through 10.1.33 - Apache Tomcat 9.0.0.M1 through 9.0.97
Description:
Credit:
Nacl, WHOAMI, Yemoli and Ruozhi (finder)
References:
https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-50379
Severity: important
Affected versions:
- Apache Tomcat 11.0.0 - Apache Tomcat 10.1.31 - Apache Tomcat 9.0.96
Description:
Incorrect object recycling and reuse vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Note: 10.1.32 includes the fix but was not released
References:
https://lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9 https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-52318
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M23 through 11.0.0-M26 - Apache Tomcat 10.1.27 through 10.1.30 - Apache Tomcat 9.0.92 through 9.0.95
Description: could lead to request and/or response mix-up between users.
References:
https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-52317
Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.0-M26 - Apache Tomcat 10.1.0-M1 through 10.1.30 - Apache Tomcat 9.0.0-M1 through 9.0.95
Description:
References:
https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928 https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-52316
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.0-M20 - Apache Tomcat 10.1.0-M1 through 10.1.24 - Apache Tomcat 9.0.13 through 9.0.89
Description:
Credit:
Ozaki, North Grid Corporation (reporter)
References:
https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-38286
Timeline:
2024-06-04: Issue reported to Apache Tomcat Security Team
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.0-M10 - Apache Tomcat 10.1.0-M1 through 10.1.15 - Apache Tomcat 9.0.0-M1 through 9.0.82 - Apache Tomcat 8.5.0 through 8.5.95
Description: request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Credit:
Norihito Aimoto (OSSTech Corporation) (finder)
References:
https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2023-46589
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.0-M11 - Apache Tomcat 10.1.0-M1 through 10.1.13 - Apache Tomcat 9.0.0-M1 through 9.0.81 - Apache Tomcat 8.5.0 through 8.5.93
Description: crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Credit: References:
https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2023-45648
[I've seen multiple news articles & blogs in the wake of the coordinated disclosure today, but no postings here yet, so lets start fixing that.]
Google, Cloudflare, AWS, and others released details today of a protocol-level issue in HTTP/2 being exploited in recent months for denial-of-service attacks:
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ https://aws.amazon.com/blogs/security/how-aws-protects-customers-from-ddos-events/
This attack works via the multiplexed streams feature of HTTP/2, in which the client repeatedly makes a request for a new stream, and then immediately sends a RSTSTREAM frame to cancel them, resulting in the server doing lots of extra work to set up and tear down the streams, while not hitting any server-side limit on a maximum number of active streams per connection.
CVE-2023-44487 was issued to track this issue across implementations: https://www.cve.org/CVERecord?id=CVE-2023-44487
A script to check for affected implemenations has been posted at: https://github.com/bcdannyboy/CVE-2023-44487
Information I've found so far on open source implementations (most via the current listings in the CVE) include:
- Apache httpd: https://chaos.social/@icing/111210915918780532
- caddy: https://github.com/caddyserver/caddy/issues/5877
- envoy: https://github.com/envoyproxy/envoy/pull/30055
- golang: https://github.com/golang/go/issues/63417 https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- h2o: https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf https://github.com/h2o/h2o/pull/3291
- haproxy: https://github.com/haproxy/haproxy/issues/2312
- hyper: https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- jetty: https://github.com/eclipse/jetty.project/issues/10679 https://github.com/eclipse/jetty.project/releases/tag/jetty-12.0.2 https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.17 https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.17 https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
- netty: https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- nghttp2: https://github.com/nghttp2/nghttp2/pull/1961 https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- nodejs: https://github.com/nodejs/node/pull/50121
- proxygen: https://github.com/facebook/proxygen/pull/466
- swift-nio-http2: https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- tomcat: https://tomcat.apache.org/security-11.html#FixedinApacheTomcat11.0.0-M12 https://tomcat.apache.org/security-10.html#FixedinApacheTomcat10.1.14 https://tomcat.apache.org/security-9.html#FixedinApacheTomcat9.0.81 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.94
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.0-M11 - Apache Tomcat 10.1.0-M1 through 10.1.13 - Apache Tomcat 9.0.0-M1 through 9.0.80 - Apache Tomcat 8.5.0 through 8.5.93
Description:
References:
https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2023-42795
Severity: low
Affected versions:
- Apache Tomcat 9.0.70 through 9.0.80 - Apache Tomcat 8.5.85 through 8.5.93
Description:
Incomplete Cleanup vulnerability in Apache Tomcat. in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Credit:
Mohammad Khedmatgozar (cellbox) (finder)
References:
https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82 https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2023-42794
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.
It was reported that Tomcat packages in Red Hat Enterprise Linux 7 are vulnerable to local privilege escalation from tomcat group user to root. Tomcat configuration file located at /usr/lib/tmpfiles.d/tomcat.conf can be modified by any user belonging to tomcat group. This file is used by /usr/bin/systemd-tmpfiles service to create temporary files.
As the systemd-tmpfiles service runs with root permissions, this enables the tomcat user to gain root privileges by editing the /usr/lib/tmpfiles.d/tomcat.conf file to contain a line which will cause the systemd-tmpfiles to create files within arbitrary system directory and arbitrary permissions.
External Reference:
http://legalhackers.com/advisories/Tomcat-RedHat-based-Root-Privilege-Escalation-Exploit.txt
Yann Rouillard reports:
Jenkins on Tomcat fails to set the httponly flag on cookies.
External references: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682 https://issues.jenkins-ci.org/browse/JENKINS-25019