Moderate Security Update for Apache Tomcat: Addressing RCE Vulnerabilities
Summary
ALSA-2025:3683: Moderate: tomcat security update. Affects tomcat versions < 1:9.0.87-1.el8_10.3. Fixed in 1:9.0.87-1.el8_10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely used servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications and is known for its scalability, reliability, and performance. However, recent vulnerabilities have been identified that could potentially expose applications running on Tomcat to remote code execution (RCE) and other security risks.
Vulnerability Detail
The vulnerabilities identified in Apache Tomcat include a TOCTOU (Time of Check to Time of Use) issue in JSP compilation (CVE-2024-50379) and a potential RCE, information disclosure, or information corruption due to partial PUT requests (CVE-2025-24813). These vulnerabilities can allow an attacker to execute arbitrary code, access sensitive information, or corrupt data, posing significant risks to applications relying on this servlet container.
How To Fix
Minimum fixed version
1:9.0.87-1.el8_10.3
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling JSP compilation or restricting the use of partial PUT requests until the packages can be updated. However, this may limit functionality and is not a permanent solution.
Conclusion
The identified vulnerabilities in Apache Tomcat pose significant risks, including remote code execution and potential data corruption. It is crucial for users to update their installations to the latest patched versions to ensure the security of their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for tomcat →
FAQ
The vulnerabilities involve remote code execution risks due to a TOCTOU issue and potential information disclosure or corruption from partial PUT requests.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Update the affected Tomcat packages to the latest patched version as soon as possible to mitigate the risks associated with these vulnerabilities.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to gain unauthorized access or execute malicious code.
Vulert is a tool that allows you to monitor open-source vulnerabilities in your applications. You can check your application's vulnerability status using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
