MiracleLinux 9 : tomcat-9.0.87-3.el9_6.3 (AXSA:2025-10779:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10779:06 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-4912...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Apache Tomcat [CVE-2025-53506]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Apache Tomcat, occuring when the HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams CVE-2025-53506. Apache Tomcat is used in our...

tomcat9 security update

An update is available for tomcat9. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Tomcat is the servlet container that is used in the official Reference...

Atlassian Jira Service Management Data Center and Server 5.12.x < 5.12.26 / 5.13.x < 10.3.9 / 10.4.x < 10.7.3 / 11.0.x < 11.0.1 DoS (JSDSERVER-16369)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16369 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not...

SUSE: Security Advisory (SUSE-SU-2025:02978-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

K000152908: Apache Tomcat vulnerabilities CVE-2025-52434 and CVE-2025-53506

Security Advisory Description CVE-2025-52434 Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issu...

Photon OS 5.0: Apache PHSA-2025-5.0-0565

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0565. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

OESA-2025-1895 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Concurrent Execution using Shar...

Debian: Security Advisory (DLA-4244-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-53506 vulnerabilities

Vulnerabilities for packages: tomcat...

CVE-2025-53506

A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service. Mitigation Mitigation for thi...

codes.vps:tomcat-valve-request-filter (1.0), com.atomgraph:linkeddatahub (>=4.0.0, <=5.4.0) +91 more potentially affected by CVE-2025-53506 via org.apache.tomcat:tomcat-coyote (>=10.1.0-m1, <=10.1.42)

org.apache.tomcat:tomcat-coyote MAVEN version =10.1.0-m1, =4.0.0, =5.0.0, =5.0.0, =3.3.0, =0.2.0, =2.8.0, =2.3.0, =1.1.0-rc1, =0.9.18, =0.9.18, =0.9.18, =0.9.18, =0.9.18, =0.9.19 and more Source cves: CVE-2025-53506 Source advisory: GHSA-25XR-QJ8W-C4VF...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13569 more potentially affected by CVE-2025-53506 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.106)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-53506 Source advisory: OSV:GHSA-25XR-QJ8W-C4VF...

com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.2.1), com.github.waffle:waffle-tomcat11 (>=3.4.0, <=3.5.1) +23 more potentially affected by CVE-2025-53506 via org.apache.tomcat:tomcat-coyote (>=11.0.0-m1, <=11.0.8)

org.apache.tomcat:tomcat-coyote MAVEN version =11.0.0-m1, =5.0.0, =3.4.0, =2.5.8, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =11.0.0-m1, =11.0.8 and more Source cves: CVE-2025-53506 Source advisory: GHSA-25XR-QJ8W-C4VF...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7521 more potentially affected by CVE-2025-53506 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.42)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-53506 Source advisory: OSV:GHSA-25XR-QJ8W-C4VF...

com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.2.1), com.github.waffle:waffle-tomcat11 (>=3.4.0, <=3.5.1) +23 more potentially affected by CVE-2025-53506 via org.apache.tomcat:tomcat-coyote (>=11.0.0-m1, <=11.0.8)

org.apache.tomcat:tomcat-coyote MAVEN version =11.0.0-m1, =5.0.0, =3.4.0, =2.5.8, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =11.0.0-m1, =11.0.8 and more Source cves: CVE-2025-53506 Source advisory: OSV:GHSA-25XR-QJ8W-C4VF...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7521 more potentially affected by CVE-2025-53506 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.42)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-53506 Source advisory: GHSA-25XR-QJ8W-C4VF...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4122 more potentially affected by CVE-2025-53506 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.100)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2025-53506 Source...

CVE-2025-53506

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7521 more potentially affected by CVE-2025-53506 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.42)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-53506 Source advisory: MEND:CVE-2025-53506...