Apache Tomcat contains a vulnerability in its rewrite rule processing that allows specially crafted requests to bypass certain rewrite rules under a subset of unlikely configurations. This bypass can circumvent security constraints enforced by those rules. The issue affects multiple versions across Tomcat 8.5.x, 9.0.x, 10.1.x, and 11.0.x branches. Fixed versions are 9.0.104, 10.1.40, and 11.0.6.
Apache Tomcat contains an improper input validation vulnerability in its HTTP priority header handling that causes incomplete cleanup of failed requests, leading to a memory leak. This can result in an OutOfMemoryException and denial of service when processing many such requests. The flaw affects multiple versions across Tomcat 8.5, 9.0, 10.1, and 11.0 branches. Fixed versions are 9.0.104, 10.1.40, and 11.0.6.
CVE-2025-3985 is a low severity vulnerability in Apereo CAS version 5.2.6 and earlier. It involves inefficient regular expression complexity in the ResponseEntity function of the cas-management-webapp-support component. This flaw can be triggered remotely by manipulating the Query argument, potentially causing a denial of service due to resource exhaustion. The vulnerability has been publicly disclosed, but no patch or vendor response is currently available.
A critical code injection vulnerability (CVE-2025-3984) exists in Apereo CAS version 5.2.6 and earlier in the saveService function of the cas-management-webapp-support component. This vulnerability involves the Groovy Code Handler and allows remote code injection. Exploitation is considered difficult due to high attack complexity. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
CVE-2024-10553 is a critical deserialization vulnerability in h2oai/h2o-3 REST API versions prior to 3.46.0.6. It allows unauthenticated remote attackers to execute arbitrary code via endpoints that deserialize untrusted data when user-controlled JDBC URLs are processed. The flaw is fixed in version 3.46.0.6.
A critical remote code execution vulnerability exists in the XWiki Platform's Solr search UI component. An unauthenticated guest user can execute arbitrary code by sending a specially crafted request to the SolrSearch endpoint. This compromises the confidentiality, integrity, and availability of the entire XWiki installation. The issue is patched in versions 15.10.11, 16.4.1, and later. Workarounds involve modifying the SolrSearchMacros XML to safely handle the feed content. Public exploit code is available, but no active exploitation in the wild is confirmed.
A cross-site scripting (XSS) vulnerability exists in the HAL Console component of Wildfly. The flaw occurs because user-controllable input is not properly neutralized before being included in web page output. Exploitation requires the attacker to be authenticated with management group privileges such as SuperUser, Admin, or Maintainer. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level. Multiple Red Hat advisories provide patches addressing this issue.
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability (CVE-2024-56337) affects Apache Tomcat versions 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1. The vulnerability relates to the default servlet write capability on case insensitive file systems and requires specific Java system property configurations to fully mitigate. Tomcat versions 9.0.98, 10.1.34, and 11.0.2 include fixes that enforce appropriate settings and disable problematic caching by default.
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability exists in Apache Tomcat during JSP compilation. This flaw permits remote code execution (RCE) on case-insensitive file systems when the default servlet is enabled for write access, which is a non-default configuration. The vulnerability affects multiple versions across Apache Tomcat 8.5, 9.0, 10.1, and 11.0 branches. Fixed versions are available and users are advised to upgrade to these to mitigate the risk.
Apache Tomcat contains an authentication bypass vulnerability (CVE-2024-52316) due to unchecked error conditions in custom Jakarta Authentication ServerAuthContext components. If such a component throws an exception during authentication without setting an HTTP failure status, authentication may incorrectly succeed. No known Jakarta Authentication components currently exhibit this behavior. The issue affects multiple Tomcat versions and is fixed in versions 9.0.96, 10.1.30, and 11.0.1.
XStream versions prior to 1.4.21 are vulnerable to a denial of service (DoS) attack caused by a stack overflow when processing manipulated input streams using the BinaryStreamDriver. This vulnerability allows a remote attacker to crash the application by triggering a stack overflow error. The issue is fixed in version 1.4.21, which detects the manipulation and raises an InputManipulationException instead of crashing. Until patched, the only workaround is to catch the StackOverflowError in client code using the BinaryStreamDriver configuration.
A vulnerability in Eclipse Jetty's ThreadLimitHandler.getRemote() allows remote attackers to cause a denial-of-service (DoS) condition by triggering out-of-memory errors through crafted requests. This affects multiple Jetty versions across supported and end-of-life branches. Fixed versions have been released to address this issue. Users are advised to avoid using ThreadLimitHandler and consider QoSHandler as a workaround.
A vulnerability in Eclipse Jetty's PushSessionCacheFilter allows unauthenticated remote attackers to cause denial of service (DoS) by exhausting server memory. This issue affects versions prior to 10.0.18, 11.0.18, and 12.0.4. The vulnerability arises from the intrinsic session usage design of the PushCacheFilter. Mitigations include avoiding use of PushCacheFilter, reducing idle timeout on unauthenticated sessions, or configuring session passivation to offload sessions from memory. Official patches are available in the fixed versions.
A denial of service (DoS) vulnerability exists in the DosFilter component of Eclipse Jetty. The flaw allows attackers to cause an OutOfMemory error by sending crafted requests, exhausting server memory. This affects versions of Jetty before the patched releases 9.4.54, 10.0.18, 11.0.18, and 12.0.3. The vulnerability arises from the internal request tracking mechanism in DosFilter when session tracking mode is enabled. The issue is mitigated by patches that remove support for session tracking mode in DosFilter.
H2O.ai H2O versions up to 3.46.0.7 are vulnerable to deserialization attacks via the JDBC Connection URL. An attacker able to send a POST request to the ImportSQLTable URI with a crafted JSON payload containing a malicious connection_url can exploit this flaw. This vulnerability allows arbitrary code execution and unauthorized file reads without requiring authentication.
The [proxy endpoint](https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/backend/rest/ProxyResource.java#L83) of openHAB's CometVisu add-on can be accessed without authentication. This proxy-feature can be exploited as Server-Side Request Forgery (SSRF) to induce GET HTTP requests to internal-only servers, in case openHAB is exposed in a non-private network.
Furthermore, this proxy-feature can also be exploited as a Cross-Site Scripting (XSS) vulnerability, as an attacker is able to re-route a request to their server and return a page with malicious JavaScript code. Since the browser receives this data directly from the openHAB CometVisu UI, this JavaScript code will be executed with the origin of the CometVisu UI. This allows an attacker to exploit call endpoints on an openHAB server even if the openHAB server is located in a private network. (e.g. by sending an openHAB admin a link that proxies malicious JavaScript.)
This vulnerability was discovered with the help of CodeQL's [Server-side request forgery](https://codeql.github.com/codeql-query-help/java/java-ssrf/) query.
## Impact
This issue may lead up to Remote Code Execution (RCE) when chained with other vulnerabilities (see: GHSL-2024-007).
Apache Tomcat versions prior to 11.0.0-M21, 10.1.25, and 9.0.90 contain a vulnerability in HTTP/2 stream processing where excessive HTTP headers are improperly handled. This causes miscounting of active HTTP/2 streams and results in an infinite timeout, allowing connections to remain open indefinitely. This can lead to denial of service by exhausting server resources. Users should upgrade to the fixed versions to resolve this issue.
CVE-2024-24749 is a vulnerability in GeoServer's GeoWebCache (GWC) Web Resource API when deployed on Windows with Apache Tomcat. It allows an attacker to bypass input validation and read arbitrary classpath resources, potentially leading to privilege escalation if the embedded data directory is used. This issue does not affect Linux or Mac OS deployments or those using Jetty or WildFly servers. A fix is available in GeoServer versions 2.23.5 and 2.24.3.
Apache Zeppelin versions prior to 0.11.1 contain a code injection vulnerability in the JDBC interpreter. An attacker can exploit this flaw by injecting malicious code or sensitive configuration through a crafted MySQL JDBC connection string. This vulnerability allows remote code execution without authentication. The issue is fixed in version 0.11.1.
A vulnerability in org.clojure:clojure allows denial of service when deserializing specially crafted serialized objects containing infinite sequences. The affected classes Cycle, Repeat, and Iterate do not override hashCode(), causing an infinite loop during deserialization of HashMap keys. This affects versions from 1.7.0 up to but not including 1.11.2 and 1.12.0-alpha1 up to but not including 1.12.0-alpha9. A fix is available in versions 1.11.2 and 1.12.0-alpha9.