Summary
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)
* tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)
* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | tomcat | 1:10.1.36-1.el10_0 |
| AlmaLinux · 10 | tomcat-admin-webapps | 1:10.1.36-1.el10_0 |
| AlmaLinux · 10 | tomcat-docs-webapp | 1:10.1.36-1.el10_0 |
| AlmaLinux · 10 | tomcat-el-5.0-api | 1:10.1.36-1.el10_0 |
| AlmaLinux · 10 | tomcat-jsp-3.1-api | 1:10.1.36-1.el10_0 |
| AlmaLinux · 10 | tomcat-lib | 1:10.1.36-1.el10_0 |
| AlmaLinux · 10 | tomcat-servlet-6.0-api | 1:10.1.36-1.el10_0 |
| AlmaLinux · 10 | tomcat-webapps | 1:10.1.36-1.el10_0 |
Vulnerabilities 3
-
Critical 10.0
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t…
KEV Apr 1, 2025 -
Critical 9.8CVE-2024-52316 Public exploit
Apache Tomcat: Authentication bypass when using Jakarta Authentication API
Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an…
-
Medium 5.3
Apache Tomcat: DoS in examples web application
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-52316
-
report
https://access.redhat.com/security/cve/CVE-2024-54677
-
report
https://access.redhat.com/security/cve/CVE-2025-24813
-
report
https://bugzilla.redhat.com/2326972
-
report
https://bugzilla.redhat.com/2332815
-
report
https://bugzilla.redhat.com/2351129
-
advisory
https://errata.almalinux.org/10/ALSA-2025-7497.html