The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14178 advisory.

    Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet     and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the     best-of-breed developers from around the world.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14179 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14183 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

    * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

    * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

    * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52520)

    * tomcat: Apache Tomcat denial of service (CVE-2025-52434)

    * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14179 advisory.

    - tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
    - tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
    - apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
    - tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
    - tomcat: Apache Tomcat denial of service (CVE-2025-52520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-606733 advisory.

    Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload.

    This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

    Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:14178 advisory.

    * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
      * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
      * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
      * tomcat: http/2 MadeYouReset DoS attack through HTTP/2 control frames (CVE-2025-48989)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52520)
      * tomcat: Apache Tomcat denial of service (CVE-2025-52434)
      * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0797 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-48976:
    Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload.

    This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

    Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

    CVE-2025-48988:
    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-48989:
    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made     you reset attack.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from     9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

    Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

    CVE-2025-49125:
    Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using     PreResources or PostResources mounted other than at the root of the web application, it was possible to     access those resources via an unexpected path. That path was likely not to be protected by the same     security constraints as the expected path, allowing those security constraints to be bypassed.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-52434:
    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client     initiated closes of HTTP/2 connections.

    This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 9.0.107, which fixes the issue.

    CVE-2025-52520:
    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat     could lead to a DoS via bypassing of size limits.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

    CVE-2025-53506:
    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge     the initial settings frame that reduces the maximum permitted concurrent streams.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0623 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-48976:
    Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload.

    This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

    Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

    CVE-2025-49125:
    Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using     PreResources or PostResources mounted other than at the root of the web application, it was possible to     access those resources via an unexpected path. That path was likely not to be protected by the same     security constraints as the expected path, allowing those security constraints to be bypassed.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-48988:
    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by a vulnerability, as referenced in the January 2026 CPU advisory:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Composer (Apache Commons FileUpload)). Supported versions that are affected are 12.2.1.4.0     and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle      Business Process Management Suite. (CVE-2025-48976)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Tika)). Supported versions that are affected are 12.2.1.4.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. While the vulnerability is in Oracle     Business Process Management Suite, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management     Suite. (CVE-2025-66516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by a vulnerability, as referenced in the January 2026 CPU advisory:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Composer (Apache Commons Lang)). The supported version that is affected is 14.1.2.0.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Process Management Suite. (CVE-2025-48924)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Composer (Apache Commons FileUpload)). Supported versions that are affected are 12.2.1.4.0     and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle      Business Process Management Suite. (CVE-2025-48976)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Oracle Business Rules (Apache Commons Compress)). The supported version that is affected is     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in takeover of Oracle Business Process Management Suite. (CVE-2025-54988)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Tika)). Supported versions that are affected are 12.2.1.4.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. While the vulnerability is in Oracle     Business Process Management Suite, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management     Suite. (CVE-2025-66516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
253047	RHEL 10 : tomcat9 (RHSA-2025:14178)	Nessus	Red Hat Local Security Checks	2025/8/20	2025/8/20	high
253059	RHEL 10 : tomcat (RHSA-2025:14179)	Nessus	Red Hat Local Security Checks	2025/8/20	2025/8/20	high
253062	RHEL 9 : tomcat (RHSA-2025:14183)	Nessus	Red Hat Local Security Checks	2025/8/20	2025/8/20	high
253655	Oracle Linux 10 : tomcat (ELSA-2025-14179)	Nessus	Oracle Linux Local Security Checks	2025/8/22	2026/1/21	high
267857	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tomcat (UTSA-2025-606733)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	high
269892	AlmaLinux 10 : tomcat9 (ALSA-2025:14178)	Nessus	Alma Linux Local Security Checks	2025/10/9	2025/10/9	high
271121	TencentOS Server 3: tomcat (TSSA-2025:0797)	Nessus	Tencent Local Security Checks	2025/10/22	2025/12/4	high
275988	TencentOS Server 4: tomcat (TSSA-2025:0623)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
294977	Oracle Business Process Management Suite (12.2.1.4.0) (January 2026 CPU)	Nessus	Misc.	2026/1/22	2026/2/4	critical
294978	Oracle Business Process Management Suite (14.1.2.0.0) (January 2026 CPU)	Nessus	Misc.	2026/1/22	2026/4/30	critical

检测

插件搜索

high

high

high

high

high

high

high

high

critical

critical