The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4244 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4244-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     July 22, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : tomcat9     Version        : 9.0.107-0+deb11u1     CVE ID         : CVE-2024-34750 CVE-2024-54677 CVE-2025-31650 CVE-2025-31651                      CVE-2025-46701 CVE-2025-48976 CVE-2025-48988 CVE-2025-49125                      CVE-2025-52434 CVE-2025-52520 CVE-2025-53506

    Several security vulnerabilities have been found in Tomcat 9, a Java web server     and servlet engine. Most notably the update improves the handling of HTTP/2     connections and corrects various flaws which can lead to uncontrolled resource     consumption and a denial of service.

    For Debian 11 bullseye, these problems have been fixed in version     9.0.107-0+deb11u1.

    We recommend that you upgrade your tomcat9 packages.

    For the detailed security status of tomcat9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely     rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those     rewrite rules effectively enforced security constraints, those constraints could be bypassed. (CVE-2025-31651)

  - Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader     class may excessively consume CPU resources when processing maliciously crafted input. (CVE-2024-47554)

  - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority     headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such     requests could trigger an OutOfMemoryException resulting in a denial of service. (CVE-2025-31650)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0.1.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.1.10 advisory.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created     but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users     are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. (CVE-2025-31651)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from     2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the     issue. (CVE-2025-48976)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through     9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected:
    8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to     version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-48988)

  - Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the     Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache     Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The     following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through     8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected. Users are recommended to     upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-49124)

  - Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using     PreResources or PostResources mounted other than at the root of the web application, it was possible to     access those resources via an unexpected path. That path was likely not to be protected by the same     security constraints as the expected path, allowing those security constraints to be bypassed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1     through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be     affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to     upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-49125)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1 advisory.

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created     but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users     are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. (CVE-2025-31651)

  - Allows modifying some file metadata (e.g. last modified) with filter=data or file permissions (chmod)     with filter=tar of files outside the extraction directory. You are affected by this vulnerability if     using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract()     using the filter= parameter with a value of data or tar. See the tarfile extraction filters     documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more     information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions     don't include the extraction filter feature. Note that for Python 3.14 or later the default value of     filter= changed from no filtering to `data, so if you are relying on this new default behavior then     your usage is also affected. Note that none of these vulnerabilities significantly affect the installation     of source distributions which are tar archives as source distributions already allow arbitrary code     execution during the build process. However when evaluating source distributions it's important to avoid     installing source distributions with suspicious links. (CVE-2024-12718)

  - Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination     directory, and the modification of some file metadata. You are affected by this vulnerability if using the     tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the     filter= parameter with a value of data or tar. See the tarfile extraction filters documentation     https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that     for Python 3.14 or later the default value of filter= changed from no filtering to `data, so if you     are relying on this new default behavior then your usage is also affected. Note that none of these     vulnerabilities significantly affect the installation of source distributions which are tar archives as     source distributions already allow arbitrary code execution during the build process. However when     evaluating source distributions it's important to avoid installing source distributions with suspicious     links. (CVE-2025-4138, CVE-2025-4330)

  - When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any     filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0     in affected versions is that the member would still be extracted and not skipped. (CVE-2025-4435)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23048 advisory.

    * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

    * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible     RCE (CVE-2025-55752)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23050 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

    * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service (CVE-2025-61795)

    * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible     RCE (CVE-2025-55752)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-23048 advisory.

    - Resolves: RHEL-124507       tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created     but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users     are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. (CVE-2025-31651)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2725 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

    * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible     RCE (CVE-2025-55752)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768821437 advisory.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created     but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users     are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. (CVE-2025-31651)

  - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression     where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for     rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to     bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were     also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are     normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in     conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1     through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions     were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older,     EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45     or later or 9.0.109 or later, which fix the issue. (CVE-2025-55752)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768821437 advisory.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created     but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users     are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. (CVE-2025-31651)

  - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression     where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for     rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to     bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were     also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are     normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in     conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1     through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions     were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older,     EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45     or later or 9.0.109 or later, which fix the issue. (CVE-2025-55752)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_23048 advisory.

    * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

    * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible     RCE (CVE-2025-55752)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1521-1 advisory.

    Update to Tomcat 9.0.104

    - CVE-2025-31650: invalid priority field values should be ignored (bsc#1242008)
    - CVE-2025-31651: Better handling of URLs with literal ';' and '?' (bsc#1242009)

    Full changelog:

    https://tomcat.apache.org/tomcat-9.0-doc/changelog.htm

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-965 advisory.

    Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP     priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A     large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

    This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from     11.0.0-M2 through 11.0.5. (CVE-2025-31650)

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. (CVE-2025-31651)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
242491	Debian dla-4244 : libtomcat9-embed-java - security update	Nessus	Debian Local Security Checks	2025/7/22	2026/1/21	high
271381	Oracle Siebel Server prior to 25.8 (October 2025 CPU)	Nessus	Misc.	2025/10/24	2025/10/24	medium
278724	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.1.10)	Nessus	Misc.	2025/12/15	2026/4/2	high
269907	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1)	Nessus	Misc.	2025/10/9	2026/9/11	high
278618	RockyLinux 8 : tomcat (RLSA-2025:23048)	Nessus	Rocky Linux Local Security Checks	2025/12/13	2025/12/13	high
278148	RHEL 10 : tomcat (RHSA-2025:23050)	Nessus	Red Hat Local Security Checks	2025/12/10	2025/12/10	high
278174	Oracle Linux 8 : tomcat (ELSA-2025-23048)	Nessus	Oracle Linux Local Security Checks	2025/12/11	2026/3/3	high
253003	Linux Distros Unpatched Vulnerability : CVE-2025-31651	Nessus	Misc.	2025/8/20	2026/7/16	critical
299158	RHEL 8 : pki-deps:10.6 (RHSA-2026:2725)	Nessus	Red Hat Local Security Checks	2026/2/16	2026/2/16	high
359638	AlmaLinux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1768821437)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
359712	Rocky Linux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1768821437)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
356038	Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_23048)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
235672	SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2025:1521-1)	Nessus	SuSE Local Security Checks	2025/5/10	2026/6/25	high
235893	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-965)	Nessus	Amazon Linux Local Security Checks	2025/5/13	2025/10/30	high
332699	Photon OS 5.0: Apache PHSA-2025-5.0-91-0519	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	high

检测

插件搜索

high

medium

high

high

high

high

high

critical

high

high

high

high

high

high

high