Skip to content
OpenAdvisories
High ALAS2-2025-2953 1 CVE

Important: tomcat security update (Amazon Linux 2)

Published Jul 29, 2025 · Updated Aug 4, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-52520: For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 tomcat 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-admin-webapps 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-docs-webapp 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-el-2.2-api 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-javadoc 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-jsp-2.2-api 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-jsvc 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-lib 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-servlet-3.0-api 0:7.0.76-10.amzn2.0.14
Amazon Linux · 2 tomcat-webapps 0:7.0.76-10.amzn2.0.14

Vulnerabilities 1

  • High 7.5
    CVE-2025-52520

    Apache Tomcat: DoS via integer overflow in multipart file upload

    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-52520.html