This Red Hat security advisory (RHSA-2025:14178) addresses several vulnerabilities in tomcat9 and related components. The issues include multiple denial of service vulnerabilities (CVE-2025-48988, CVE-2025-48989, CVE-2025-52520, CVE-2025-52434, CVE-2025-53506), a security constraint bypass (CVE-2025-49125), and a denial of service in Apache Commons FileUpload via part headers (CVE-2025-48976). These vulnerabilities affect the servlet container used in the Java Servlet and JavaServer Pages technologies. The advisory provides updated tomcat9 packages for Red Hat Enterprise Linux 10 and its extended update support variants. The vendor classifies the update as Important, indicating a high security impact. The advisory references multiple bugzilla entries and CVE pages for detailed information. The vendor advisory confirms that fixes are available and provides instructions for applying the update.

The vulnerabilities collectively allow attackers to cause denial of service conditions in Apache Tomcat through various vectors such as multipart upload handling, HTTP/2 control frames, and malformed part headers in file uploads. Additionally, a security constraint bypass vulnerability could allow unauthorized access to protected resources. These issues can disrupt service availability and potentially expose sensitive resources due to bypassed security constraints. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated tomcat9 packages for Red Hat Enterprise Linux 10 and its extended update support versions that address these vulnerabilities. Users should apply the provided security update as detailed in the Red Hat advisory RHSA-2025:14178 and the referenced article https://access.redhat.com/articles/11258. Applying this official update is the recommended and effective mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.