Red Hat Security Advisory: tomcat9 security update

Apache Tomcat, the servlet container for Java Servlet and JavaServer Pages technologies, has multiple security flaws addressed in Red Hat security advisories. The primary issue is a remote code execution vulnerability (CVE-2024-50379) caused by a TOCTOU race condition during JSP compilation. Additionally, a denial of service vulnerability (CVE-2025-31650) exists via malformed HTTP/2 PRIORITY_UPDATE frames. Red Hat has issued patches for affected versions across multiple Red Hat Enterprise Linux distributions and JBoss Web Server releases. The advisories confirm that fixes are available and provide guidance for applying updates.

Successful exploitation of CVE-2024-50379 could allow an attacker to execute arbitrary code remotely due to a TOCTOU flaw in JSP compilation. CVE-2025-31650 could enable denial of service conditions via malformed HTTP/2 frames. These vulnerabilities pose significant risks to affected systems running vulnerable versions of Tomcat, potentially leading to system compromise or service disruption.

Red Hat has released official security updates that fix these vulnerabilities. Users should apply the provided patches promptly according to Red Hat's update instructions. The vendor advisory explicitly confirms that patches are available and remediation is provided through updated packages. No additional mitigation steps beyond applying the official updates are indicated.