The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68677 advisory.

    * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
      * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
      * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication. (CVE-2026-42498)
      * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
      * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
      * tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI     configuration (CVE-2026-55957)
      * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve     (CVE-2026-59083)
      * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure     configurations (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1151 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-52316:
    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC)ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known     JakartaAuthentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

    CVE-2024-54677:
    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

    CVE-2025-46701:
    Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security     constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI     servlet.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from     9.0.0.M1 through 9.0.104.

    Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

    CVE-2025-55668:
    Session Fixation vulnerability in Apache Tomcat via rewrite valve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.
    Older, EOL versions may also be affected.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-55754:
    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.

    Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a     Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker     to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard     and attempt to trick an administrator into running an attacker controlled command. While no attack vector     was found, it may have been possible to mount this attack on other operating systems.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from     9.0.40 through 9.0.108.

    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
    Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which     fix the issue.

    CVE-2025-61795:
    Improper Resource Shutdown or Release vulnerability in Apache Tomcat.

    If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary     copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage     collection process to delete. Depending on JVM settings, application memory usage and application load, it     was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared     it, leading to a DoS.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from     9.0.0.M1 through 9.0.109.

    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
    Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which     fixes the issue.

    CVE-2025-66614:
    Improper Input Validation vulnerability.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from     9.0.0-M1 through 9.0.112.

    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.
    Tomcat did not validate that the host name provided via the SNI     extension was the same as the host name provided in the HTTP host header     field. If Tomcat was configured with more than one virtual host and the     TLS configuration for one of those hosts did not require client     certificate authentication but another one did, it was possible for a     client to bypass the client certificate authentication by sending     different host names in the SNI extension and the HTTP host header field.



    The vulnerability only applies if client certificate authentication is     only enforced at the Connector. It does not apply if client certificate     authentication is enforced at the web application.


    Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which     fix the issue.

    CVE-2026-24733:
    Improper Input Validation vulnerability in Apache Tomcat.


    Tomcat did not limit HTTP/0.9 requests to the GET method. If a security     constraint was configured to allow HEAD requests to a URI but deny GET     requests, the user could bypass that constraint on GET requests by     sending a (specification invalid) HEAD request using HTTP/0.9.


    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from     9.0.0.M1 through 9.0.112.


    Older, EOL versions are also affected.

    Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which     fixes the issue.

    CVE-2026-24880:
    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache     Tomcat via invalid chunk extension.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from     9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Other, unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

    CVE-2026-25854:
    Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the     LoadBalancerDrainingValve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from     9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
    Other, unsupported versions may also be affected

    Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

    CVE-2026-29145:
    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat, Apache Tomcat Native.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from     9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from     1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

    Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and     9.0.116, which fix the issue.

    CVE-2026-34483:
    Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache     Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from     9.0.40 through 9.0.116.

    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.

    CVE-2026-34487:
    Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering     component of Apache Tomcat exposed the Kubernetes bearer token.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from     9.0.13 through 9.0.116.

    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

    CVE-2026-41284:
    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117.
    Older, unsupported versions may also be affected.

    Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    CVE-2026-41293:
    Improper Input Validation vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.
    Older, end of support versions may also be affected.

    Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    CVE-2026-42498:
    Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability     in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.

    CVE-2026-43512:
    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.
    Older unsupported versions any also be affect

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43513:
    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Older unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43514:
    Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Older unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43515:
    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same     extension in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-50229:
    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number     guess example for Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-53404:
    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-53434:
    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from     9.0.83 through 9.0.118.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

    CVE-2026-55276:
    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100.Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

    CVE-2026-55955:
    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

    CVE-2026-55956:
    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-55957:
    Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured     to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct     password.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from     9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

    Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

    CVE-2026-59083:
    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100.Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

    CVE-2026-59084:
    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.Other versions that     have reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The version of Tomcat installed on the remote host is prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.2_security-11 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through     10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or     9.0.98, which fixes the issue. (CVE-2024-50379)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version     11.0.2, 10.1.34 or 9.0.98, which fixes the issue. (CVE-2024-54677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.34. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.34_security-10 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through     10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or     9.0.98, which fixes the issue. (CVE-2024-50379)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version     11.0.2, 10.1.34 or 9.0.98, which fixes the issue. (CVE-2024-54677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-814 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request     and response used by HTTP/2 requestscould lead to request and/or response mix-up between users.

    This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from     9.0.92 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
    (CVE-2024-52317)

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-54677)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 9.0.98-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2025-015 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-54677)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the     CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be     affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-54677)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2829 advisory.

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-54677)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1.7 advisory.

  - Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information     disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache     Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34,     from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the     following were true, a malicious user was able to view security sensitive files and/or inject content into     those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT     (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target     URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the     security sensitive files also being uploaded via partial PUT If all of the following were true, a     malicious user was able to perform remote code execution: - writes enabled for the default servlet     (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file     based session persistence with the default storage location - application included a library that may be     leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or     9.0.99, which fixes the issue. (CVE-2025-24813)

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements     in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE:
    this is similar to CVE-2017-9047. (CVE-2025-24928)

  - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were     designated as globally reachable or private. This affected the is_private and is_global properties of     the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network     classes, where values wouldn't be returned in accordance with the latest information from the IANA     Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these     registries and thus have the intended behavior. (CVE-2024-4032)

  - A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote     code execution via its download functions. These functions, which are used to download packages from URLs     provided by users or retrieved from package index servers, are susceptible to code injection. If these     functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands     on the system. The issue is fixed in version 70.0. (CVE-2024-6345)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.1.1 advisory.

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9840)

  - Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information     disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache     Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34,     from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the     following were true, a malicious user was able to view security sensitive files and/or inject content into     those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT     (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target     URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the     security sensitive files also being uploaded via partial PUT If all of the following were true, a     malicious user was able to perform remote code execution: - writes enabled for the default servlet     (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file     based session persistence with the default storage location - application included a library that may be     leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or     9.0.99, which fixes the issue. (CVE-2025-24813)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:7497 advisory.

    * tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)

    * tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)

    * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT     (CVE-2025-24813)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4244 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4244-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     July 22, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : tomcat9     Version        : 9.0.107-0+deb11u1     CVE ID         : CVE-2024-34750 CVE-2024-54677 CVE-2025-31650 CVE-2025-31651                      CVE-2025-46701 CVE-2025-48976 CVE-2025-48988 CVE-2025-49125                      CVE-2025-52434 CVE-2025-52520 CVE-2025-53506

    Several security vulnerabilities have been found in Tomcat 9, a Java web server     and servlet engine. Most notably the update improves the handling of HTTP/2     connections and corrects various flaws which can lead to uncontrolled resource     consumption and a denial of service.

    For Debian 11 bullseye, these problems have been fixed in version     9.0.107-0+deb11u1.

    We recommend that you upgrade your tomcat9 packages.

    For the detailed security status of tomcat9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-813 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-54677)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0394-1 advisory.

    - CVE-2024-50379: Fixed remote code execution (RCE) due to TOCTOU issue in JSP compilation (bsc#1234663).
    - CVE-2024-54677: Fixed denial-of-service (DoS) attack in examples web application (bsc#1234664).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
347977	AlmaLinux 8 : tomcat (ALSA-2026:68677)	Nessus	Alma Linux Local Security Checks	2026/9/18	2026/9/25	medium
365137	TencentOS Server 3: tomcat (TSSA-2026:1151)	Nessus	Tencent Local Security Checks	2026/10/12	2026/10/12	medium
215224	Photon OS 5.0: Apache PHSA-2025-5.0-0445	Nessus	PhotonOS Local Security Checks	2025/2/10	2026/10/14	critical
214266	Photon OS 4.0: Apache PHSA-2025-4.0-0729	Nessus	PhotonOS Local Security Checks	2025/1/16	2026/11/2	critical
332441	Photon OS 5.0: Apache PHSA-2025-5.0-91-0445	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/2	critical
213076	Apache Tomcat 11.0.0.M1 < 11.0.2 multiple vulnerabilities	Nessus	Web Servers	2024/12/17	2025/3/13	critical
213077	Apache Tomcat 10.1.0.M1 < 10.1.34 multiple vulnerabilities	Nessus	Web Servers	2024/12/17	2025/3/13	critical
214611	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-814)	Nessus	Amazon Linux Local Security Checks	2025/1/24	2025/3/13	critical
214622	Amazon Linux 2 : tomcat (ALASTOMCAT9-2025-015)	Nessus	Amazon Linux Local Security Checks	2025/1/24	2025/3/13	critical
231792	Linux Distros Unpatched Vulnerability : CVE-2024-54677	Nessus	Misc.	2025/3/6	2026/11/6	medium
234520	Amazon Linux 2 : tomcat (ALAS-2025-2829)	Nessus	Amazon Linux Local Security Checks	2025/4/17	2025/4/17	high
242590	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.7)	Nessus	Misc.	2025/7/22	2025/9/1	critical
255240	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.1.1)	Nessus	Misc.	2025/8/26	2026/4/19	high
266642	RockyLinux 10 : tomcat (RLSA-2025:7497)	Nessus	Rocky Linux Local Security Checks	2025/10/6	2025/10/6	critical
242491	Debian dla-4244 : libtomcat9-embed-java - security update	Nessus	Debian Local Security Checks	2025/7/22	2026/1/21	high
214604	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-813)	Nessus	Amazon Linux Local Security Checks	2025/1/24	2025/3/13	critical
216197	SUSE SLES12 Security Update : tomcat (SUSE-SU-2025:0394-1)	Nessus	SuSE Local Security Checks	2025/2/12	2025/3/13	critical

检测

插件搜索

medium

medium

critical

critical

critical

critical

critical

critical

critical

medium

high

critical

high

critical

high

critical

critical