Moderate Vulnerability in Apache Tomcat: Authentication Bypass and DoS Risks
Summary
ALSA-2025:7497: Moderate: tomcat security update. Affects tomcat versions < 1:10.1.36-1.el10_0. Fixed in 1:10.1.36-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely used servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It is known for its robust performance and flexibility in deploying Java applications. However, recent vulnerabilities have been identified that could compromise its security, including an authentication bypass and potential denial of service (DoS) in the examples web application.
Vulnerability Detail
The vulnerabilities identified in Apache Tomcat include an authentication bypass when using the Jakarta Authentication API (CVE-2024-52316), a denial of service (DoS) issue in the examples web application (CVE-2024-54677), and a potential remote code execution (RCE) or information disclosure/corruption with partial PUT requests (CVE-2025-24813). These vulnerabilities can lead to unauthorized access, service interruptions, and data integrity issues, posing significant risks to applications relying on Tomcat.
How To Fix
Minimum fixed version
1:10.1.36-1.el10_0
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the examples web application to mitigate the DoS risk until the update can be applied. This can be done by removing or renaming the examples directory in the Tomcat webapps folder.
Conclusion
The identified vulnerabilities in Apache Tomcat pose moderate risks that can lead to unauthorized access and service disruptions. It is crucial for users to update to the patched version to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for tomcat →
FAQ
The authentication bypass vulnerability allows unauthorized users to gain access to protected resources, which can lead to data breaches and unauthorized actions within the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider disabling vulnerable components, such as the examples web application, and monitor your application closely for any suspicious activity.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers to gain unauthorized access or disrupt services.
Detailed information about the vulnerabilities, including CVSS scores and acknowledgments, can be found on the respective CVE pages: CVE-2024-52316, CVE-2024-54677, and CVE-2025-24813.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
