Red Hat Security Advisory: tomcat security update
Red Hat has issued a security advisory for Apache Tomcat addressing multiple denial of service (DoS) vulnerabilities and a security constraint bypass. The vulnerabilities affect multipart upload processing, HTTP/2 control frames, and Apache Commons FileUpload part headers. The advisory covers Red Hat Enterprise Linux 8.8 variants and provides updated Tomcat packages to fix these issues. No CVSS scores are provided, but the vulnerabilities are rated as having a high security impact. No known exploits in the wild have been reported at this time.
AI Analysis
Technical Summary
This Red Hat security advisory addresses seven vulnerabilities in Apache Tomcat and related components, including CVE-2025-48976 (Apache Commons FileUpload DoS via part headers), CVE-2025-48988 (Tomcat DoS in multipart upload), CVE-2025-48989 (HTTP/2 "MadeYouReset" DoS attack), CVE-2025-49125 (security constraint bypass for pre/post-resources), and three additional denial of service issues (CVE-2025-52434, CVE-2025-52520, CVE-2025-53506). These vulnerabilities could allow denial of service conditions or bypass of security constraints in affected Tomcat deployments. The advisory provides updated Tomcat packages for Red Hat Enterprise Linux 8.8 variants to remediate these issues.
Potential Impact
The vulnerabilities can lead to denial of service conditions in Apache Tomcat through various attack vectors such as malformed multipart uploads, HTTP/2 control frames, and malformed part headers in file uploads. One vulnerability allows bypassing security constraints related to resource access. These issues could disrupt service availability or weaken access controls in affected environments. No active exploitation has been reported.
Mitigation Recommendations
Red Hat has released updated Tomcat packages for Red Hat Enterprise Linux 8.8 variants that address these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2025:14182 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations or workarounds are indicated. Patch status is confirmed as fixed in the updated packages.
Red Hat Security Advisory: tomcat security update
Description
Red Hat has issued a security advisory for Apache Tomcat addressing multiple denial of service (DoS) vulnerabilities and a security constraint bypass. The vulnerabilities affect multipart upload processing, HTTP/2 control frames, and Apache Commons FileUpload part headers. The advisory covers Red Hat Enterprise Linux 8.8 variants and provides updated Tomcat packages to fix these issues. No CVSS scores are provided, but the vulnerabilities are rated as having a high security impact. No known exploits in the wild have been reported at this time.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory addresses seven vulnerabilities in Apache Tomcat and related components, including CVE-2025-48976 (Apache Commons FileUpload DoS via part headers), CVE-2025-48988 (Tomcat DoS in multipart upload), CVE-2025-48989 (HTTP/2 "MadeYouReset" DoS attack), CVE-2025-49125 (security constraint bypass for pre/post-resources), and three additional denial of service issues (CVE-2025-52434, CVE-2025-52520, CVE-2025-53506). These vulnerabilities could allow denial of service conditions or bypass of security constraints in affected Tomcat deployments. The advisory provides updated Tomcat packages for Red Hat Enterprise Linux 8.8 variants to remediate these issues.
Potential Impact
The vulnerabilities can lead to denial of service conditions in Apache Tomcat through various attack vectors such as malformed multipart uploads, HTTP/2 control frames, and malformed part headers in file uploads. One vulnerability allows bypassing security constraints related to resource access. These issues could disrupt service availability or weaken access controls in affected environments. No active exploitation has been reported.
Mitigation Recommendations
Red Hat has released updated Tomcat packages for Red Hat Enterprise Linux 8.8 variants that address these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2025:14182 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations or workarounds are indicated. Patch status is confirmed as fixed in the updated packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:14182
- Cve Count
- 7
- Additional Cves
- ["CVE-2025-48988","CVE-2025-48989","CVE-2025-49125","CVE-2025-52434","CVE-2025-52520","CVE-2025-53506"]
Threat ID: 6a419cb627e9c79719abd571
Added to database: 06/28/2026, 22:14:14 UTC
Last enriched: 08/04/2026, 15:50:17 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.