Red Hat Product Security issued an advisory (RHSA-2025:3645) for Apache Tomcat in Red Hat Enterprise Linux 9, addressing two vulnerabilities: CVE-2024-50379, a TOCTOU race condition in JSP compilation that allows remote code execution, and CVE-2025-24813, which may allow remote code execution, information disclosure, or corruption through partial PUT requests. The advisory provides updated Tomcat packages (version 9.0.87-2.el9_5.1) that fix these vulnerabilities. The affected products include multiple Red Hat Enterprise Linux 9 variants across architectures (x86_64, s390x, ppc64le, aarch64). No CVSS scores are provided in the advisory, but the issues are rated as moderate impact. No known exploits in the wild have been reported at the time of the advisory.

Successful exploitation of CVE-2024-50379 could allow an attacker to execute arbitrary code remotely due to a TOCTOU flaw in JSP compilation. CVE-2025-24813 could allow remote code execution, information disclosure, or data corruption via partial HTTP PUT requests. These vulnerabilities could compromise the confidentiality, integrity, and availability of affected systems running vulnerable Tomcat versions. The advisory rates the overall impact as moderate.

Red Hat has released updated Tomcat packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9 should apply the security update described in advisory RHSA-2025:3645 promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.