Apache Tomcat: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• High 8.4
  CVE-2025-49124

  Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

  Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 thro…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
  Jun 16, 2025
• High 7.5
  CVE-2025-48988 Public exploit EPSS 31%

  Apache Tomcat: FileUpload large number of parts with headers DoS

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time th…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• High 7.5
  CVE-2025-49125 Public exploit

  Apache Tomcat: Security constraint bypass for pre/post-resources

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That pa…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 16, 2025

Revision history

1. 2026-09-17 #33

   Neue Updates von Oracle Linux aufgenommen

2. 2026-07-21 #32

   Neue Updates von IBM aufgenommen

3. 2026-06-25 #31

   Neue Updates von IBM aufgenommen

4. 2026-03-26 #30

   Neue Updates von SUSE aufgenommen

5. 2026-03-23 #29

   Neue Updates von Dell aufgenommen

6. 2026-02-05 #28

   Neue Updates von Debian aufgenommen

7. 2025-12-21 #27

   Neue Updates von Dell aufgenommen

8. 2025-11-30 #26

   Neue Updates von Dell aufgenommen

9. 2025-11-19 #25

   Neue Updates von IBM aufgenommen

10. 2025-11-17 #24

    Neue Updates von XEROX aufgenommen

11. 2025-11-04 #23

    Neue Updates von Dell aufgenommen

12. 2025-10-05 #22

    Neue Updates aufgenommen

13. 2025-09-29 #21

    Neue Updates von HITACHI aufgenommen

14. 2025-09-08 #20

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

15. 2025-08-31 #19

    Neue Updates von SUSE aufgenommen

16. 2025-08-25 #18

    Neue Updates von SUSE aufgenommen

17. 2025-08-24 #17

    Neue Updates von Oracle Linux aufgenommen

18. 2025-08-21 #16

    Neue Updates von Oracle Linux aufgenommen

19. 2025-08-20 #15

    Neue Updates von Red Hat und Oracle Linux aufgenommen

20. 2025-08-19 #14

    Neue Updates aufgenommen

21. 2025-08-13 #13

    Neue Updates von IBM und IBM-APAR aufgenommen

22. 2025-08-05 #12

    Neue Updates von HCL aufgenommen

23. 2025-07-30 #11

    Neue Updates von Red Hat aufgenommen

24. 2025-07-29 #10

    Neue Updates aufgenommen

25. 2025-07-28 #9

    Neue Updates von Red Hat aufgenommen

References

• Mailing list OSS Security vom 2025-06-16
  https://seclists.org/oss-sec/2025/q2/252
• Red Hat Bugtracker #2373015 vom 2025-06-16
  https://bugzilla.redhat.com/show_bug.cgi?id=2373015
• GitHub Security Advisory GHSA-h3gc-qfqq-6h8f vom 2025-06-16
  https://github.com/advisories/GHSA-h3gc-qfqq-6h8f
• Mailing list OSS Security vom 2025-06-16
  https://seclists.org/oss-sec/2025/q2/254
• GitHub Security Advisory GHSA-42wg-hm62-jcwg vom 2025-06-16
  https://github.com/advisories/GHSA-42wg-hm62-jcwg
• Mailing list OSS Security vom 2025-06-16
  https://seclists.org/oss-sec/2025/q2/253
• Red Hat Bugtracker #2373018 vom 2025-06-16
  https://bugzilla.redhat.com/show_bug.cgi?id=2373018
• GitHub Security Advisory GHSA-wc4r-xq3c-5cf3 vom 2025-06-16
  https://github.com/advisories/GHSA-wc4r-xq3c-5cf3
• PoC CVE-2025-48988 & CVE-2025-48976 vom 2025-06-20
  https://github.com/Samb102/POC-CVE-2025-48988-CVE-2025-48976
• SUSE Security Update SUSE-SU-2025:02214-1 vom 2025-07-03
  https://lists.suse.com/pipermail/sle-security-updates/2025-July/021747.html
• openSUSE Security Update OPENSUSE-SU-2025:15302-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3Q3VIWON6R2C3IL77AVMV6SIM4TZ245T/
• openSUSE Security Update OPENSUSE-SU-2025:15303-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L6B6HQCE7RRJR2L5C65YNRDK55ZWHNXT/
• openSUSE Security Update OPENSUSE-SU-2025:15301-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BTOO3WDF3PKT7VMIVPGD3B6THLWKJFDW/
• SUSE Security Update SUSE-SU-2025:02261-1 vom 2025-07-09
  https://lists.suse.com/pipermail/sle-security-updates/2025-July/021777.html
• Amazon Linux Security Advisory ALAS2TOMCAT9-2025-020 vom 2025-07-10
  https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2025-020.html
• SUSE Security Update SUSE-SU-2025:02280-1 vom 2025-07-10
  https://lists.suse.com/pipermail/sle-security-updates/2025-July/021790.html
• Amazon Linux Security Advisory ALAS2-2025-2919 vom 2025-07-10
  https://alas.aws.amazon.com/AL2/ALAS2-2025-2919.html
• IBM Security Bulletin 7239757 vom 2025-07-15
  https://www.ibm.com/support/pages/node/7239757
• Atlassian Security Bulletin - July 15 2025
  https://confluence.atlassian.com/security/security-bulletin-july-15-2025-1590658642.html
• Debian Security Advisory DLA-4244 vom 2025-07-22
  https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
• Red Hat Security Advisory RHSA-2025:11696 vom 2025-07-28
  https://access.redhat.com/errata/RHSA-2025:11696
• Red Hat Security Advisory RHSA-2025:11695 vom 2025-07-28
  https://access.redhat.com/errata/RHSA-2025:11695
• Absolute Security Information vom 2025-07-30
  https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1356
• Red Hat Security Advisory RHSA-2025:11741 vom 2025-07-30
  https://access.redhat.com/errata/RHSA-2025:11741
• Red Hat Security Advisory RHSA-2025:11742 vom 2025-07-30
  https://access.redhat.com/errata/RHSA-2025:11742
• Camunda Notice 140 vom 2025-07-30
  https://docs.camunda.org/security/notices/#notice-140
• HCL Security Bulletin vom 2025-08-05
  https://support.hcl-software.com/community?id=community_blog&sys_id=4cd4383f3bcb26d828f8f547f4e45af6
• IBM Security Bulletin 7242150 vom 2025-08-14
  https://www.ibm.com/support/pages/node/7242150
• Atlassian Security Bulletin - August 19 2025 vom 2025-08-19
  https://confluence.atlassian.com/security/security-bulletin-august-19-2025-1621491738.html
• Red Hat Security Advisory RHSA-2025:14179 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14179
• Red Hat Security Advisory RHSA-2025:14183 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14183
• Red Hat Security Advisory RHSA-2025:14177 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14177
• Red Hat Security Advisory RHSA-2025:14178 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14178
• Red Hat Security Advisory RHSA-2025:14182 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14182
• Red Hat Security Advisory RHSA-2025:14180 vom 2025-08-21
  https://access.redhat.com/errata/RHSA-2025:14180
• Red Hat Security Advisory RHSA-2025:14181 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14181
• Oracle Linux Security Advisory ELSA-2025-14177 vom 2025-08-21
  https://linux.oracle.com/errata/ELSA-2025-14177.html
• Oracle Linux Security Advisory ELSA-2025-14181 vom 2025-08-21
  https://linux.oracle.com/errata/ELSA-2025-14181.html
• Oracle Linux Security Advisory ELSA-2025-14178 vom 2025-08-21
  https://linux.oracle.com/errata/ELSA-2025-14178.html
• Oracle Linux Security Advisory ELSA-2025-14179 vom 2025-08-22
  https://linux.oracle.com/errata/ELSA-2025-14179.html
• SUSE Security Update SUSE-SU-2025:02979-1 vom 2025-08-25
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022273.html
• SUSE Security Update SUSE-SU-2025:02978-1 vom 2025-08-25
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022274.html
• SUSE Security Update SUSE-SU-2025:03024-1 vom 2025-08-29
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022345.html
• Rocky Linux Security Advisory RLSA-2025:14177 vom 2025-09-08
  https://errata.build.resf.org/RLSA-2025:14177
• Hitachi Vulnerability Information HITACHI-SEC-2025-127 vom 2025-09-30
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-127/index.html
• SAS Security Update vom 2025-10-02
  https://support.sas.com/en/security-bulletins/sas-security-update-for-sas-94m9-ts1m9.html
• Dell Security Advisory DSA-2025-390 vom 2025-11-05
  https://www.dell.com/support/kbdoc/000385230
• XEROX Security Advisory XRX25-018 vom 2025-11-18
  https://security.business.xerox.com/wp-content/uploads/2025/11/Xerox-Security-Bulletin-XRX25-018-Xerox-FreeFlow-Print-Server-v7.pdf
• IBM Security Bulletin 7252039 vom 2025-11-20
  https://www.ibm.com/support/pages/node/7252039
• Dell Security Advisory DSA-2025-365 vom 2025-12-01
  https://www.dell.com/support/kbdoc/de-de/000397532/dsa-2025-365-security-update-for-dell-networker-multiple-third-party-component-vulnerabilities
• Dell Security Advisory DSA-2025-415 vom 2025-12-22
  https://www.dell.com/support/kbdoc/000405813
• Debian Security Advisory DSA-6121 vom 2026-02-05
  https://lists.debian.org/debian-security-announce/2026/msg00030.html
• Debian Security Advisory DSA-6120 vom 2026-02-05
  https://lists.debian.org/debian-security-announce/2026/msg00029.html
• Dell Security Advisory DSA-2026-152 vom 2026-03-23
  https://www.dell.com/support/kbdoc/de-de/000443243/dsa-2026-152-dell-secure-connect-gateway-security-update-for-multiple-third-party-component-vulnerabilities
• SUSE Security Update SUSE-SU-2026:1058-1 vom 2026-03-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024949.html
• IBM Security Bulletin 7278011 vom 2026-06-25
  https://www.ibm.com/support/pages/node/7278011
• IBM Security Bulletin 7280368 vom 2026-07-21
  https://www.ibm.com/support/pages/node/7280368
• Oracle Linux Security Advisory ELSA-2026-68660 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68660.html