Red Hat Security Advisory: tomcat9 security update
Multiple security vulnerabilities affecting Apache Tomcat 9, as packaged in Red Hat Enterprise Linux 10, have been addressed in a security update. These include denial of service (DoS) issues via multipart upload, HTTP/2 control frames, and Apache Commons FileUpload part headers, as well as a security constraint bypass vulnerability. The update fixes seven CVEs related to these issues. Red Hat has released patches for affected versions and recommends applying the update to mitigate these vulnerabilities.
AI Analysis
Technical Summary
This advisory covers several security vulnerabilities in Apache Tomcat 9 and related components included in Red Hat Enterprise Linux 10. The issues include denial of service vulnerabilities (CVE-2025-48988, CVE-2025-48989, CVE-2025-48976, CVE-2025-52520, CVE-2025-52434, CVE-2025-53506) and a security constraint bypass vulnerability (CVE-2025-49125). The denial of service vulnerabilities arise from multipart upload handling, HTTP/2 control frames, and Apache Commons FileUpload part headers. The security constraint bypass affects pre/post-resources in Tomcat. Red Hat has issued an important security update (RHSA-2025:14178) that addresses these issues in tomcat9 packages for Red Hat Enterprise Linux 10.
Potential Impact
Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service conditions in Apache Tomcat 9, potentially disrupting service availability. The security constraint bypass vulnerability could allow unauthorized access to restricted resources. The overall impact is rated as important by Red Hat, indicating a high severity level but not critical. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released an official security update (RHSA-2025:14178) that patches all identified vulnerabilities in tomcat9 packages for Red Hat Enterprise Linux 10. Users should apply the update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patches.
Red Hat Security Advisory: tomcat9 security update
Description
Multiple security vulnerabilities affecting Apache Tomcat 9, as packaged in Red Hat Enterprise Linux 10, have been addressed in a security update. These include denial of service (DoS) issues via multipart upload, HTTP/2 control frames, and Apache Commons FileUpload part headers, as well as a security constraint bypass vulnerability. The update fixes seven CVEs related to these issues. Red Hat has released patches for affected versions and recommends applying the update to mitigate these vulnerabilities.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers several security vulnerabilities in Apache Tomcat 9 and related components included in Red Hat Enterprise Linux 10. The issues include denial of service vulnerabilities (CVE-2025-48988, CVE-2025-48989, CVE-2025-48976, CVE-2025-52520, CVE-2025-52434, CVE-2025-53506) and a security constraint bypass vulnerability (CVE-2025-49125). The denial of service vulnerabilities arise from multipart upload handling, HTTP/2 control frames, and Apache Commons FileUpload part headers. The security constraint bypass affects pre/post-resources in Tomcat. Red Hat has issued an important security update (RHSA-2025:14178) that addresses these issues in tomcat9 packages for Red Hat Enterprise Linux 10.
Potential Impact
Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service conditions in Apache Tomcat 9, potentially disrupting service availability. The security constraint bypass vulnerability could allow unauthorized access to restricted resources. The overall impact is rated as important by Red Hat, indicating a high severity level but not critical. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released an official security update (RHSA-2025:14178) that patches all identified vulnerabilities in tomcat9 packages for Red Hat Enterprise Linux 10. Users should apply the update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:14178
- Cve Count
- 7
- Additional Cves
- ["CVE-2025-48988","CVE-2025-48989","CVE-2025-49125","CVE-2025-52434","CVE-2025-52520","CVE-2025-53506"]
Threat ID: 6a419cb727e9c79719abd88d
Added to database: 06/28/2026, 22:14:15 UTC
Last enriched: 08/04/2026, 15:49:28 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.