Critical Security Update for Apache Tomcat: Addressing RCE and DoS Vulnerabilities
Summary
ALSA-2025:11333: Important: tomcat security update. Affects tomcat versions < 1:9.0.87-1.el8_10.4. Fixed in 1:9.0.87-1.el8_10.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used open-source servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications and is known for its scalability and robustness. However, recent vulnerabilities have been identified that could potentially compromise the security of applications running on Tomcat, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities stem from an incomplete fix for CVE-2024-50379, which allows for remote code execution (RCE) due to a time-of-check to time-of-use (TOCTOU) issue in JSP compilation. Additionally, CVE-2025-31650 exposes the system to denial-of-service (DoS) attacks via malformed HTTP/2 PRIORITY_UPDATE frames. These vulnerabilities could lead to unauthorized access and service disruption, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
1:9.0.87-1.el8_10.4
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Tomcat server by implementing firewall rules to limit incoming traffic or by disabling HTTP/2 support until the update can be applied. This can be done by modifying the server configuration files to disable the HTTP/2 protocol.
Conclusion
The recent vulnerabilities in Apache Tomcat highlight the importance of timely updates and security measures. Users are strongly encouraged to update to the latest patched version to mitigate risks associated with remote code execution and denial-of-service attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for tomcat →
FAQ
The vulnerabilities can lead to remote code execution and denial-of-service attacks, potentially compromising the integrity and availability of applications running on Tomcat.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider implementing firewall rules to restrict access or disabling HTTP/2 support as a temporary workaround.
Detailed information about the vulnerabilities, including CVSS scores and acknowledgments, can be found on the CVE pages linked in the advisory.
Yes, you can use the Vulert playground at Vulert Scanner to monitor and check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
