Skip to content
OpenAdvisories
High ALAS2023-2025-1093 3 CVEs

Important: tomcat10 security update (Amazon Linux 2023)

Published Jul 21, 2025 · Updated Sep 10, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-55668: Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. CVE-2025-53506: Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue. CVE-2025-52520: For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 tomcat10 1:10.1.43-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-admin-webapps 1:10.1.43-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-docs-webapp 1:10.1.43-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-el-5.0-api 1:10.1.43-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-jsp-3.1-api 1:10.1.43-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-lib 1:10.1.43-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-servlet-6.0-api 1:10.1.43-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-webapps 1:10.1.43-1.amzn2023.0.1

Vulnerabilities 3

  • High 7.5
    CVE-2025-52520

    Apache Tomcat: DoS via integer overflow in multipart file upload

    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2025-53506

    Apache Tomcat: DoS via excessive h2 streams at connection start

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2025-55668 Public exploit

    Apache Tomcat: session fixation via rewrite valve

    Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-52520.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53506.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-55668.html