Description
A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a denial of service (CPU consumption) via a crafted request. NOTE: this vulnerability exists because of an unspecified regression.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | tomcat +9 | 7.0.42-5.el7_0 | RHSA-2014:0686 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | tomcat +9 | 7.0.42-5.el7_0 | ELSA-2014-0686 |
Advisories 3
- RHSA-2014:0686 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2023-0754 Apache Tomcat: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 26, 2023
- ELSA-2014-0686 Important: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 20, 2014