Skip to content
OpenAdvisories
High ALAS2-2025-2920 1 CVE

Important: tomcat security update (Amazon Linux 2)

Published Jul 2, 2025 · Updated Jul 10, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-48976: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 tomcat 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-admin-webapps 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-docs-webapp 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-el-2.2-api 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-javadoc 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-jsp-2.2-api 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-jsvc 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-lib 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-servlet-3.0-api 0:7.0.76-10.amzn2.0.12
Amazon Linux · 2 tomcat-webapps 0:7.0.76-10.amzn2.0.12

Vulnerabilities 1

  • High 7.5
    CVE-2025-48976 Public exploit EPSS 33%

    Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

    Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

    Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-48976.html