Apache Tomcat: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• Critical 9.6
  CVE-2025-55754 EPSS 10%

  Apache Tomcat: console manipulation via escape sequences in log messages

  Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape …

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  Oct 27, 2025
• High 7.5
  CVE-2025-55752 Public exploit EPSS 64%

  Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

  Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the UR…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  Oct 27, 2025
• Medium 5.3
  CVE-2025-61795

  Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS

  Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but lef…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Oct 27, 2025

Revision history

1. 2026-09-17 #36

   Neue Updates von Oracle Linux aufgenommen

2. 2026-07-21 #35

   Neue Updates von Oracle Linux und IBM aufgenommen

3. 2026-06-29 #34

   Neue Updates von Oracle Linux aufgenommen

4. 2026-06-22 #33

   Neue Updates aufgenommen

5. 2026-05-31 #32

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

6. 2026-05-19 #31

   Neue Updates von Red Hat aufgenommen

7. 2026-05-18 #30

   Neue Updates von Red Hat aufgenommen

8. 2026-04-09 #29

   Neue Updates von SUSE aufgenommen

9. 2026-04-06 #28

   Neue Updates von openSUSE aufgenommen

10. 2026-03-31 #27

    Neue Updates von IBM aufgenommen

11. 2026-03-26 #26

    Neue Updates von SUSE aufgenommen

12. 2026-03-24 #25

    Neue Updates von IBM aufgenommen

13. 2026-03-23 #24

    Neue Updates von Dell aufgenommen

14. 2026-03-17 #23

    Neue Updates von Dell aufgenommen

15. 2026-02-15 #22

    Neue Updates von Red Hat aufgenommen

16. 2026-02-05 #21

    Neue Updates von Debian aufgenommen

17. 2026-01-20 #20

    Neue Updates von SUSE aufgenommen

18. 2026-01-15 #19

    Neue Updates von openSUSE aufgenommen

19. 2026-01-13 #18

    Neue Updates aufgenommen

20. 2026-01-07 #17

    Neue Updates von Red Hat aufgenommen

21. 2025-12-15 #16

    Neue Updates von Red Hat aufgenommen

22. 2025-12-14 #15

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

23. 2025-12-11 #14

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

24. 2025-12-10 #13

    Neue Updates von Red Hat, Rocky Enterprise Software Foundation, SUSE und Oracle Linux aufgenommen

25. 2025-12-09 #12

    Neue Updates von Red Hat aufgenommen

References

• NIST Vulnerability Database vom 2025-10-27
  https://nvd.nist.gov/vuln/detail/CVE-2025-55752
• NIST Vulnerability Database vom 2025-10-27
  https://nvd.nist.gov/vuln/detail/CVE-2025-55754
• NIST Vulnerability Database vom 2025-10-27
  https://nvd.nist.gov/vuln/detail/CVE-2025-61795
• Apache Tomcat Security vom 2025-10-27
  https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110
• Apache Tomcat Security vom 2025-10-27
  https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47
• Apache Tomcat Security vom 2025-10-27
  https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12
• PoC CVE-2025-55752 vom 2025-10-28
  https://github.com/TAM-K592/CVE-2025-55752
• Red Hat Security Advisory RHSA-2025:19810 vom 2025-11-06
  https://access.redhat.com/errata/RHSA-2025:19810
• Red Hat Security Advisory RHSA-2025:19809 vom 2025-11-06
  https://access.redhat.com/errata/RHSA-2025:19809
• openSUSE Security Update OPENSUSE-SU-2025:15718-1 vom 2025-11-08
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W6PIRHQGOVWPZCOQCITPWJOJF46KPRH3/
• openSUSE Security Update OPENSUSE-SU-2025:15716-1 vom 2025-11-08
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JUHQUF6GI6WNIB2OLHZWSVMV36C2EJIC/
• Amazon Linux Security Advisory ALAS2-2025-3067 vom 2025-11-11
  https://alas.aws.amazon.com/AL2/ALAS2-2025-3067.html
• Amazon Linux Security Advisory ALAS2TOMCAT9-2025-023 vom 2025-11-11
  https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2025-023.html
• SUSE Security Update SUSE-SU-2025:4086-1 vom 2025-11-12
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023270.html
• IBM Security Bulletin 7250971 vom 2025-11-12
  https://www.ibm.com/support/pages/node/7250971
• SUSE Security Update SUSE-SU-2025:4103-1 vom 2025-11-14
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023281.html
• IBM Security Bulletin 7251634 vom 2025-11-18
  https://www.ibm.com/support/pages/node/7251634
• SUSE Security Update SUSE-SU-2025:4159-1 vom 2025-11-21
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023311.html
• SUSE Security Update SUSE-SU-2025:4184-1 vom 2025-11-24
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023318.html
• openSUSE Security Update OPENSUSE-SU-2025-20106-1 vom 2025-11-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FPPZ6FSW6UKHPCGEBSEZ2WIKZC77TX7I/
• Camunda Security Notices vom 2025-12-01
  https://docs.camunda.org/security/notices/
• Red Hat Security Advisory RHSA-2025:22924 vom 2025-12-09
  https://access.redhat.com/errata/RHSA-2025:22924
• Red Hat Security Advisory RHSA-2025:22925 vom 2025-12-09
  https://access.redhat.com/errata/RHSA-2025:22925
• Red Hat Security Advisory RHSA-2025:23050 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23050
• Rocky Linux Security Advisory RLSA-2025:23049 vom 2025-12-11
  https://errata.build.resf.org/RLSA-2025:23049
• Red Hat Security Advisory RHSA-2025:23044 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23044
• Red Hat Security Advisory RHSA-2025:23045 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23045
• Red Hat Security Advisory RHSA-2025:23046 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23046
• Red Hat Security Advisory RHSA-2025:23047 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23047
• Red Hat Security Advisory RHSA-2025:23048 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23048
• Red Hat Security Advisory RHSA-2025:23049 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23049
• Red Hat Security Advisory RHSA-2025:23052 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23052
• Red Hat Security Advisory RHSA-2025:23051 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23051
• Red Hat Security Advisory RHSA-2025:23053 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23053
• SUSE Security Update SUSE-SU-2025:21152-1 vom 2025-12-10
  https://lists.suse.com/pipermail/sle-security-updates/2025-December/023508.html
• Oracle Linux Security Advisory ELSA-2025-23050 vom 2025-12-11
  https://linux.oracle.com/errata/ELSA-2025-23050.html
• Oracle Linux Security Advisory ELSA-2025-23052 vom 2025-12-11
  http://linux.oracle.com/errata/ELSA-2025-23052.html
• Oracle Linux Security Advisory ELSA-2025-23049 vom 2025-12-11
  http://linux.oracle.com/errata/ELSA-2025-23049.html
• Oracle Linux Security Advisory ELSA-2025-23048 vom 2025-12-11
  http://linux.oracle.com/errata/ELSA-2025-23048.html
• Rocky Linux Security Advisory RLSA-2025:23050 vom 2025-12-12
  https://errata.build.resf.org/RLSA-2025:23050
• Rocky Linux Security Advisory RLSA-2025:23052 vom 2025-12-12
  https://errata.build.resf.org/RLSA-2025:23052
• Rocky Linux Security Advisory RLSA-2025:23048 vom 2025-12-13
  https://errata.build.resf.org/RLSA-2025:23048
• Red Hat Security Advisory RHSA-2025:23225 vom 2025-12-15
  https://access.redhat.com/errata/RHSA-2025:23225
• Red Hat Security Advisory RHSA-2026:0293 vom 2026-01-08
  https://access.redhat.com/errata/RHSA-2026:0293
• Red Hat Security Advisory RHSA-2026:0292 vom 2026-01-08
  https://access.redhat.com/errata/RHSA-2026:0292
• Absolute Security Information
  https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1420
• openSUSE Security Update OPENSUSE-SU-2026:20034-1 vom 2026-01-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/46BV2V24ZXE5GEADLKEMOLVOJO4PD253/
• SUSE Security Update SUSE-SU-2026:20084-1 vom 2026-01-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023815.html
• Debian Security Advisory DSA-6120 vom 2026-02-05
  https://lists.debian.org/debian-security-announce/2026/msg00029.html
• Debian Security Advisory DSA-6121 vom 2026-02-05
  https://lists.debian.org/debian-security-announce/2026/msg00030.html
• Debian Security Advisory DLA-4468 vom 2026-02-05
  https://lists.debian.org/debian-lts-announce/2026/02/msg00007.html
• Red Hat Security Advisory RHSA-2026:2726 vom 2026-02-16
  https://access.redhat.com/errata/RHSA-2026:2726
• Red Hat Security Advisory RHSA-2026:2724 vom 2026-02-16
  https://access.redhat.com/errata/RHSA-2026:2724
• Red Hat Security Advisory RHSA-2026:2725 vom 2026-02-16
  https://access.redhat.com/errata/RHSA-2026:2725
• Dell Security Advisory DSA-2026-057 vom 2026-03-18
  https://www.dell.com/support/kbdoc/000440823
• Dell Security Advisory DSA-2026-152 vom 2026-03-23
  https://www.dell.com/support/kbdoc/de-de/000443243/dsa-2026-152-dell-secure-connect-gateway-security-update-for-multiple-third-party-component-vulnerabilities
• IBM Security Bulletin 7267332 vom 2026-03-24
  https://www.ibm.com/support/pages/node/7267332
• SUSE Security Update SUSE-SU-2026:1058-1 vom 2026-03-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024949.html
• IBM Security Bulletin 7268151 vom 2026-03-31
  https://www.ibm.com/support/pages/node/7268151
• openSUSE Security Update OPENSUSE-SU-2026:20444-1 vom 2026-04-02
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RFDMXLL4REOVIN7K7LZGE5CKASEYSWXH/
• SUSE Security Update SUSE-SU-2026:20982-1 vom 2026-04-09
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025183.html
• Red Hat Security Advisory RHSA-2026:18536 vom 2026-05-19
  https://access.redhat.com/errata/RHSA-2026:18536
• Red Hat Security Advisory RHSA-2026:18537 vom 2026-05-19
  https://access.redhat.com/errata/RHSA-2026:18537
• Red Hat Security Advisory RHSA-2026:18916 vom 2026-05-19
  https://access.redhat.com/errata/RHSA-2026:18916
• Rocky Linux Security Advisory RLSA-2026:18537 vom 2026-05-29
  https://errata.build.resf.org/RLSA-2026:18537
• Solarwinds SEM Release Notes vom 2026-06-23
  https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2026-2_release_notes.htm
• Oracle Linux Security Advisory ELSA-2026-18916 vom 2026-06-29
  https://linux.oracle.com/errata/ELSA-2026-18916.html
• Oracle Linux Security Advisory ELSA-2026-18536 vom 2026-07-22
  https://linux.oracle.com/errata/ELSA-2026-18536.html
• IBM Security Bulletin 7280368 vom 2026-07-21
  https://www.ibm.com/support/pages/node/7280368
• Oracle Linux Security Advisory ELSA-2026-18537 vom 2026-07-22
  https://linux.oracle.com/errata/ELSA-2026-18537.html
• Oracle Linux Security Advisory ELSA-2026-68660 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68660.html