The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14179 advisory.

    - tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
    - tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
    - tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - tomcat: Apache Tomcat denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11695 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster),     the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 5.8.5 serves as a replacement for Red Hat JBoss Web Server 5.8.4.
    This release includes bug fixes, enhancements and component upgrades, which are documented in the Release     Notes that are linked to in the References section.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload [jws-5] (CVE-2025-48988)
    * tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-5]     (CVE-2025-49125)
    * tomcat: Apache Commons FileUpload DoS via part headers [jws-5] (CVE-2025-48976)
    * jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52520)
    * jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52434)
    * jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1093 advisory.

    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat     could lead to a DoS via bypassing of size limits.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
    (CVE-2025-52520)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge     the initial settings frame that reduces the maximum permitted concurrent streams.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
    (CVE-2025-53506)

    Session Fixation vulnerability in Apache Tomcat via rewrite valve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.Older, EOL versions may also be affected.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
    (CVE-2025-55668)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02745-1 advisory.

    - CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart     upload (bsc#1246388)
    - CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0797 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-48976:
    Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload.

    This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

    Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

    CVE-2025-48988:
    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-48989:
    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made     you reset attack.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from     9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

    Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

    CVE-2025-49125:
    Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using     PreResources or PostResources mounted other than at the root of the web application, it was possible to     access those resources via an unexpected path. That path was likely not to be protected by the same     security constraints as the expected path, allowing those security constraints to be bypassed.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-52434:
    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client     initiated closes of HTTP/2 connections.

    This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 9.0.107, which fixes the issue.

    CVE-2025-52520:
    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat     could lead to a DoS via bypassing of size limits.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

    CVE-2025-53506:
    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge     the initial settings frame that reduces the maximum permitted concurrent streams.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:14178 advisory.

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
      * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
      * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
      * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52520)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52434)
      * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
253655	Oracle Linux 10 : tomcat (ELSA-2025-14179)	Nessus	Oracle Linux Local Security Checks	2025/8/22	2026/1/21	high
242932	RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.8.5 (RHSA-2025:11695)	Nessus	Red Hat Local Security Checks	2025/7/28	2025/7/28	high
243501	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-1093)	Nessus	Amazon Linux Local Security Checks	2025/8/4	2026/1/21	high
249093	SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2025:02745-1)	Nessus	SuSE Local Security Checks	2025/8/12	2026/6/25	high
271121	TencentOS Server 3: tomcat (TSSA-2025:0797)	Nessus	Tencent Local Security Checks	2025/10/22	2025/12/4	high
269892	AlmaLinux 10 : tomcat9 (ALSA-2025:14178)	Nessus	Alma Linux Local Security Checks	2025/10/9	2025/10/9	high

检测

插件搜索

high

high

high

high

high

high