Apache Tomcat versions 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49 and 8.5.0 to 8.5.27 only apply security constraints defined by Servlets once those Servlets are loaded. Depending on the order that Servlets load, some security constraints may not be applied leading to unintended resource exposure.

External References:

https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.85 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.50 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.28

Upstream Fixes:

Tomcat 7.0.x:

http://svn.apache.org/viewvc?view=rev&rev=1823322 http://svn.apache.org/viewvc?view=rev&rev=1824360

Tomcat 8.0.x:

http://svn.apache.org/viewvc?view=rev&rev=1823319 http://svn.apache.org/viewvc?view=rev&rev=1824359

Tomcat 8.5.x:

http://svn.apache.org/viewvc?view=rev&rev=1823314 http://svn.apache.org/viewvc?view=rev&rev=1824358

Apache Tomcat versions 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49 and 8.5.0 to 8.5.27 does not properly handle the URL empty string ("") when used as part of a security constraint definition. This can lead to the security constraint being ignored, leading to unitended exposure of resources.

External References:

https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.85 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.50 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.28

Upstream Bug Report:

https://bz.apache.org/bugzilla/showbug.cgi?id=62067

Upstream Fixes:

Tomcat 7.0.x:

http://svn.apache.org/viewvc?view=rev&rev=1823309

Tomcat 8.0.x:

http://svn.apache.org/viewvc?view=rev&rev=1814827

Tomcat 8.5.x:

http://svn.apache.org/viewvc?view=rev&rev=1823307

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2decode in libjasper/jp2/jp2dec.c, leading to a denial of service.

A flaw was found in Apache tomcat. When the default servlet returned a redirect to a directory (e.g. redirecting to /foo/ when the user requested /foo) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

References:

https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E

An issue was discovered in libjpeg 9a and 9d. The allocsarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

Last updated 25 August 2025

Last updated 18 August 2025

ResourceLinkFactory.setGlobalContext() is a public method and was accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt other web applications and/or read and write data owned by other web applications.

External references:

http://seclists.org/bugtraq/2016/Feb/147

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

It was discovered that the JAXP component of OpenJDK did not properly count total size of the expanded general entities and therefore did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application parse a specially crafted XML file could use this flaw to make the application use and excessive amount of memory and possibly exit on out of memory condition.

JAXP XML parsing limits are described on the following page:

https://docs.oracle.com/javase/tutorial/jaxp/limits/limits.html

It was discovered that the RMIConnector and RMIConnectionImpl classes in the JMX component of OpenJDK could log sensitive information such as user passwords in its debug log, possibly leading the exposure of the information.

A flaw was found in the deserialization of the URL class in the Networking component of OpenJDK. Deserialization of the specially crafted data could result in creation of the URL object with an inconsistent state. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

Last updated 30 June 2026

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client.

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINABASE/webapps directory.

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

Last updated 24 July 2024

It was discovered that ICC profiles were not parsed correctly. An untrusted Java application or applet could possibly use this flaw to cause a denial of service.

A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock() and a BUG() in fs/ext4/ext4.h:2057, It is tested on 4.14 and 5.16, it randomly got segmentation faults in either systemd or other libc functions after the bug is triggered twice or more with below traces.

================================================================== [ 99.129641] BUG: KASAN: use-after-free in dxinsertblock+0xf9/0x1e0 [ 99.129678] Read of size 199528 at addr ffff88825d339028 by task tmp32/1078

[ 99.129729] CPU: 3 PID: 1078 Comm: tmp32 Not tainted 5.4.171 #1 [ 99.129730] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 99.129731] Call Trace: [ 99.129734] dumpstack+0x8b/0xb9 [ 99.129736] ? dxinsertblock+0xf9/0x1e0 [ 99.129739] printaddressdescription.constprop.4+0x23/0x400 [ 99.129740] ? dxinsertblock+0xf9/0x1e0 [ 99.129742] kasanreport+0x15c/0x1e0 [ 99.129743] ? dxinsertblock+0xf9/0x1e0 [ 99.129744] kasanreport+0x10/0x20 [ 99.129746] checkmemoryregion+0x149/0x1a0 [ 99.129747] memmove+0x1f/0x50 [ 99.129748] dxinsertblock+0xf9/0x1e0 [ 99.129750] dosplit+0x105b/0x1bf0 [ 99.129754] ? ext4renamedirfinish+0x820/0x820 [ 99.129755] ext4dxaddentry+0x30b/0x2a20 [ 99.129757] ? condresched+0x15/0x30 [ 99.129759] ? getblkgfp+0x35/0x7f0 [ 99.129760] ? adddirenttobuf+0x630/0x630 [ 99.129761] ? memset+0x1f/0x40 [ 99.129763] ? fscryptsetupfilename+0x32/0xce0 [ 99.129765] ? ext4getblk+0x127/0x3d0 [ 99.129766] ? dosyscall64+0x9a/0x390 [ 99.129768] ? entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129769] ? ext4iomapbegin+0xf10/0xf10 [ 99.129771] ? addtransactioncredits+0x13d/0xaf0 [ 99.129772] ? memset+0x1f/0x40 [ 99.129773] ? ext4fnamesetupfilename+0xd1/0x1f0 [ 99.129775] ? memset+0x1f/0x40 [ 99.129776] ext4addentry+0x6c7/0xcd0 [ 99.129778] ? makeindexeddir+0x1130/0x1130 [ 99.129779] ? jbd2journalgetwriteaccess+0xaf/0x120 [ 99.129781] ? ext4journalgetwriteaccess+0x41/0x70 [ 99.129782] ? jbd2journalstart+0x2d6/0x760 [ 99.129784] ext4rename+0xef9/0x1e00 [ 99.129786] ? avchaspermnoaudit+0x1b3/0x380 [ 99.129787] ? ext4tmpfile+0x3a0/0x3a0 [ 99.129788] ? avchasextendedperms+0xe80/0xe80 [ 99.129790] ? selinuxpathnotify+0x460/0x460 [ 99.129792] vfsrename+0x84f/0x1550 [ 99.129794] ? tomoyocredprepare+0xb1/0x160 [ 99.129795] ? vfsmkdir+0x5a0/0x5a0 [ 99.129796] ? dalloc+0x56/0x210 [ 99.129797] ? dorenameat2+0x78a/0x970 [ 99.129798] dorenameat2+0x78a/0x970 [ 99.129800] ? userpathcreate+0x30/0x30 [ 99.129801] ? lockrefputreturn+0xd7/0x190 [ 99.129803] ? blkpreruntimesuspend+0x280/0x280 [ 99.129804] ? kmemcachealloc+0x177/0x220 [ 99.129805] ? mntgetcount+0x1e0/0x1e0 [ 99.129806] ? dput+0x5a/0x760 [ 99.129808] ? pathsetxattr+0xb9/0x130 [ 99.129809] ? setxattr+0x240/0x240 [ 99.129810] ? fgetlight+0x55/0x1f0 [ 99.129811] ? fgetlight+0x55/0x1f0 [ 99.129813] x64sysrename+0x5a/0x80 [ 99.129814] dosyscall64+0x9a/0x390 [ 99.129815] ? prepareexittousermode+0xec/0x1a0 [ 99.129817] entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129819] RIP: 0033:0x7f8665863639

In SQLite before 3.32.3 select.c mishandles query-flattener optimization leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

ext/fts3/fts3snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.

Last updated 25 August 2025

Last updated 25 August 2025

Last updated 25 August 2025

Last updated 18 August 2025

iproute2 before 5.1.0 has a use-after-free in getnetnsidfromname in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorizedkeys file).

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refreshprogressmeter() in progressmeter.c.

An unspecified error with the mishandling of pExpr->y.pTab in the sqlite3ExprCodeTarget function in expr.c in SQLite has an unknown impact and attack vector.

In SQLite through 3.29.0 whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlitestat1 sz field aka a "severe division by zero in the query planner."