The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6120 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6120-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     February 05, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : tomcat10     CVE ID         : CVE-2025-46701 CVE-2025-48976 CVE-2025-48988 CVE-2025-48989                      CVE-2025-49125 CVE-2025-52520 CVE-2025-53506 CVE-2025-55668                      CVE-2025-55752 CVE-2025-55754 CVE-2025-61795 CVE-2025-31650                      CVE-2025-31651     Debian Bug     : 1106820 1108119 1108117 1111097 1108115 1109112 1109114 1111099 1119294


    Several security vulnerabilities have been found in Tomcat 10, a Java web     server and servlet engine. This update improves the handling of HTTP/2     connections and corrects various flaws which can lead to uncontrolled resource     consumption and a denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 10.1.52-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 10.1.52-1~deb13u1.

    We recommend that you upgrade your tomcat10 packages.

    For the detailed security status of tomcat10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat10

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18536 advisory.

    Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet     and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the     best-of-breed developers from around the world.

    Security Fix(es):

    * tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)

    * org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve     (CVE-2025-55668)

    * org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18916 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)

    * org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve     (CVE-2025-55668)

    * org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18536 advisory.

    - Resolves: RHEL-150720       Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
    - Resolves:
      Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500)
    - Resolves:
      Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (CVE-2026-34487)
    - Resolves:
      Tomcat: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor (CVE-2026-34486)
    - Resolves:
      Tomcat: Incomplete escaping of JSON access logs (CVE-2026-34483)
    - Resolves:
      Tomcat: The fix for CVE-2025-66614 was incomplete (CVE-2026-32990)
    - Resolves:
      Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (CVE-2026-29146)
    - Resolves:
      Tomcat: OCSP checks sometimes soft-fail even when soft-fail is disabled (CVE-2026-29145)
    - Resolves:
      Tomcat: Configured TLS cipher preference order not preserved (CVE-2026-29129)
    - Resolves:
      Tomcat: Occasionally open redirect (CVE-2026-25854)
    - Resolves:
      Tomcat: Request smuggling via invalid chunk extension (CVE-2026-24880)
    - Resolves:
      Tomcat: Incomplete OCSP verification checks (CVE-2026-24734)
    - Resolves:
      Tomcat: Security constraint bypass (CVE-2026-24733)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1093 advisory.

    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat     could lead to a DoS via bypassing of size limits.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
    (CVE-2025-52520)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge     the initial settings frame that reduces the maximum permitted concurrent streams.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from     9.0.0.M1 through 9.0.106.

    Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
    (CVE-2025-53506)

    Session Fixation vulnerability in Apache Tomcat via rewrite valve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.Older, EOL versions may also be affected.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
    (CVE-2025-55668)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.106. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.106_security-9 advisory.

  - Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the     Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache     Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The     following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through     8.5.100 and 7.0.95 through 7.0.109. Users are recommended to upgrade to version 11.0.8, 10.1.42 or     9.0.106, which fix the issue. (CVE-2025-49124)

  - Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL     versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106,     which fix the issue. (CVE-2025-55668)

  - Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using     PreResources or PostResources mounted other than at the root of the web application, it was possible to     access those resources via an unexpected path. That path was likely not to be protected by the same     security constraints as the expected path, allowing those security constraints to be bypassed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1     through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be     affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to     upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-49125)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through     9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected:
    8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to     version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-48988)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from     2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the     issue. (CVE-2025-48976)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
298164	Debian dsa-6120 : libtomcat10-embed-java - security update	Nessus	Debian Local Security Checks	2026/2/5	2026/3/3	high
315317	RHEL 10 : tomcat9 (RHSA-2026:18536)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/5/19	medium
315422	RHEL 9 : tomcat (RHSA-2026:18916)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/5/19	medium
328894	Oracle Linux 10 : tomcat9 (ELSA-2026-18536)	Nessus	Oracle Linux Local Security Checks	2026/7/22	2026/7/22	medium
243501	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-1093)	Nessus	Amazon Linux Local Security Checks	2025/8/4	2026/1/21	high
240060	Apache Tomcat 9.0.0.M1 < 9.0.106 multiple vulnerabilities	Nessus	Web Servers	2025/6/16	2026/1/21	high

偵測

搜尋 Plugin

high

medium

medium

medium

high

high