The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986098 advisory.

    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made     you reset attack.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from     9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

    Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0736 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-48989:
    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made     you reset attack.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from     9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

    Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (Apache Log4j)). Supported versions that are affected are 17.0-25.10. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Siebel CRM Deployment accessible data. (CVE-2024-31141, CVE-2025-27817)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (Apache Tomcat)). Supported versions that are affected are 17.0-25.10. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Siebel CRM Deployment. (CVE-2025-48989)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14178 advisory.

    Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet     and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the     best-of-breed developers from around the world.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14179 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14183 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14179 advisory.

    - tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
    - tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
    - tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - tomcat: Apache Tomcat denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:14178 advisory.

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
      * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
      * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
      * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52520)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52434)
      * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0797 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-48976:
    Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload.

    This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

    Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

    CVE-2025-48988:
    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-48989:
    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made     you reset attack.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from     9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

    Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

    CVE-2025-49125:
    Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using     PreResources or PostResources mounted other than at the root of the web application, it was possible to     access those resources via an unexpected path. That path was likely not to be protected by the same     security constraints as the expected path, allowing those security constraints to be bypassed.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-52434:
    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client     initiated closes of HTTP/2 connections.

    This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 9.0.107, which fixes the issue.

    CVE-2025-52520:
    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat     could lead to a DoS via bypassing of size limits.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

    CVE-2025-53506:
    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge     the initial settings frame that reduces the maximum permitted concurrent streams.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
268604	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tomcat (UTSA-2025-986098)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	high
275937	TencentOS Server 4: tomcat (TSSA-2025:0736)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
294865	Oracle Siebel Server <= 25.10 (January 2026 CPU)	Nessus	Misc.	2026/1/21	2026/1/21	high
253047	RHEL 10 : tomcat9 (RHSA-2025:14178)	Nessus	Red Hat Local Security Checks	2025/8/20	2025/8/20	high
253059	RHEL 10 : tomcat (RHSA-2025:14179)	Nessus	Red Hat Local Security Checks	2025/8/20	2025/8/20	high
253062	RHEL 9 : tomcat (RHSA-2025:14183)	Nessus	Red Hat Local Security Checks	2025/8/20	2025/8/20	high
253655	Oracle Linux 10 : tomcat (ELSA-2025-14179)	Nessus	Oracle Linux Local Security Checks	2025/8/22	2026/1/21	high
269892	AlmaLinux 10 : tomcat9 (ALSA-2025:14178)	Nessus	Alma Linux Local Security Checks	2025/10/9	2025/10/9	high
271121	TencentOS Server 3: tomcat (TSSA-2025:0797)	Nessus	Tencent Local Security Checks	2025/10/22	2025/12/4	high

检测

插件搜索

high

high

high

high

high

high

high

high

high