The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02992-1 advisory.

    Updated to Tomcat 11.0.10
    - CVE-2025-48989: Fixed 'MadeYouReset' DoS in HTTP/2 due to client triggered stream reset (bsc#1243895)

    Other fixes:
      * Catalina
        - Fix: Fix bloom filter population for archive indexing when using a           packed WAR containing one or more JAR files. (markt)
      * Coyote
        - Fix: 69748: Add missing call to set keep-alive timeout when using           HTTP/1.1 following an async request, which was present for AJP.
          (remm/markt)
        - Fix: 69762: Fix possible overflow during HPACK decoding of integers.
          Note that the maximum permitted value of an HPACK decoded integer is           Integer.MAX_VALUE. (markt)
        - Fix: Update the HTTP/2 overhead documentation - particularly the code           comments - to reflect the deprecation of the PRIORITY frame and           clarify that a stream reset always triggers an overhead increase.
          (markt)
      * Cluster
        - Update: Add enableStatistics configuration attribute for the           DeltaManager, defaulting to true. (remm)
      * WebSocket
        - Fix: Align the WebSocket extension handling for WebSocket client           connections with WebSocket server connections. The WebSocket client           now only includes an extension requested by an endpoint in the           opening handshake if the WebSocket client supports that extension.
          (markt)
      * Web applications
        - Fix: Manager and Host Manager. Provide the Manager and Host Manager           web applications with a dedicated favicon file rather than using the           one from the ROOT web application which might not be present or may           represent something entirely different. Pull requests #876 and #878           by Simon Arame.
      * Other
        - Update: Update Checkstyle to 10.26.1. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:14178 advisory.

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6121 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6121-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     February 05, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : tomcat11     CVE ID         : CVE-2025-46701 CVE-2025-48976 CVE-2025-48988 CVE-2025-48989                      CVE-2025-49125 CVE-2025-52520 CVE-2025-53506 CVE-2025-55668                      CVE-2025-55752 CVE-2025-55754 CVE-2025-61795     Debian Bug     : 1106821 1108118 1108116 1111096 1108114 1109111 1109113 1111098


    Several security vulnerabilities have been found in Tomcat 11, a Java web     server and servlet engine. This update improves the handling of HTTP/2     connections and corrects various flaws which can lead to uncontrolled resource     consumption and a denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 11.0.15-1~deb13u1.

    We recommend that you upgrade your tomcat11 packages.

    For the detailed security status of tomcat11 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat11

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.44. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.44_security-10 advisory.

  - Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service     typically manifested as an OutOfMemoryError. (CVE-2025-48989)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14182 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14180 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14181 advisory.

    - Resolves: RHEL-102200       tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - Resolves: RHEL-108491       tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
    - Resolves: RHEL-108499       tomcat: Dos in multipart upload (CVE-2025-48988)
    - Resolves: RHEL-108507       tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - Resolves: RHEL-108515       tomcat: Denial of service (CVE-2025-52434)
    - Resolves: RHEL-108531       tomcat: Denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
258057	SUSE SLES15 / openSUSE 15 Security Update : tomcat11 (SUSE-SU-2025:02992-1)	Nessus	SuSE Local Security Checks	2025/8/28	2026/1/21	high
266661	RockyLinux 10 : tomcat9 (RLSA-2025:14178)	Nessus	Rocky Linux Local Security Checks	2025/10/6	2025/10/6	high
298161	Debian dsa-6121 : libtomcat11-embed-java - security update	Nessus	Debian Local Security Checks	2026/2/5	2026/3/3	high
249230	Apache Tomcat 10.1.0.M1 < 10.1.44	Nessus	Web Servers	2025/8/13	2026/1/21	high
253049	RHEL 8 : tomcat (RHSA-2025:14182)	Nessus	Red Hat Local Security Checks	2025/8/20	2025/8/20	high
253061	RHEL 9 : tomcat (RHSA-2025:14180)	Nessus	Red Hat Local Security Checks	2025/8/20	2025/8/20	high
253511	Oracle Linux 9 : tomcat (ELSA-2025-14181)	Nessus	Oracle Linux Local Security Checks	2025/8/21	2026/1/21	high

检测

插件搜索

high

high

high

high

high

high

high