Red Hat Security Advisory: tomcat9 security update

CVE-2025-24813 is a vulnerability in tomcat9 that allows potential remote code execution, information disclosure, or information corruption through partial PUT HTTP requests. The issue affects various versions of tomcat9 included in Red Hat Enterprise Linux 10 and Red Hat JBoss Web Server 5.8.3. Red Hat has issued security advisories and released updated packages to fix this vulnerability. The vulnerability is rated as moderate in severity by Red Hat Product Security. No CVSS score is provided in the advisory. The vulnerability is tracked under CWE-41 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

The vulnerability could allow an attacker to execute arbitrary code remotely, disclose sensitive information, or corrupt information by exploiting partial PUT requests to the tomcat9 servlet container. This could compromise the confidentiality, integrity, and availability of affected systems running vulnerable versions of tomcat9. Red Hat classifies the impact as moderate.

A security update is available from Red Hat to address CVE-2025-24813. Users of affected Red Hat Enterprise Linux 10 and Red Hat JBoss Web Server versions should apply the provided patches as detailed in the Red Hat advisories (RHSA-2025:7494 and RHSA-2025:3455). The vendor advisory provides instructions on how to apply these updates. No additional mitigation steps are indicated beyond applying the official patches.