102 matches found
Astra Linux – vulnerability in nghttp2, netty, tomcat9, jetty9, grpc
The HTTP/2 protocol enables denial-of-service conditions server resource exhaustion since request cancellation can rapidly reset multiple streams; this was exploited in the wild from August to October 2023...
Astra Linux – vulnerability in Tomcat9
The uncontrolled resource consumption vulnerability in the example web application included with Apache Tomcat can lead to a denial of service. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, and from 9.0.0.M1 through 9.9.97. The following...
Astra Linux – vulnerability in Tomcat9
Apache Tomcat versions 10.0.0-M1 through 10.0.6, 9.0.0.M1 through 9.0.46, and 8.5.0 through 8.5.66 failed to properly parse the HTTP transfer-encoding request header under certain conditions, which could potentially lead to request smuggling when used with a reverse proxy. Specifically: - Tomcat...
Astra Linux – vulnerability in libcommons-fileupload-java, tomcat9
The allocation of resources for multipart headers when limits are insufficient led to a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: versions prior to 1.6 from 1.0, and versions prior to 2.0.0-M4 from 2.0.0-M1. Users are advised to upgrade to versi...
Astra Linux – Vulnerability in Tomcat9
A vulnerability related to observable timing discrepancies occurs when comparing AJP secrets in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109...
Astra Linux – Vulnerability in Tomcat9
Apache Tomcat versions 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43, and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop, resulting in a denial of...
Astra Linux – Vulnerability in Tomcat9
The “Allocation of Resources Without Limits or Throttling” vulnerability in Apache Tomcat exists. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, and from 9.0.0.M1 through 9.0.105. The following versions were already at the end of their...
Astra Linux – Vulnerability in Tomcat9, libcommons-fileupload-java
Apache Commons FileUpload before version 1.5 does not limit the number of request parts that can be processed, which means that an attacker could potentially trigger a Denial-of-Service attack with a malicious upload or series of uploads. It’s important to note that, like all file upload...
Astra Linux – Vulnerability in Tomcat9
A denial-of-service attack occurs due to a vulnerability related to improper input validation in HTTP/2 requests handled by Apache Tomcat. When processing an HTTP/2 request, if the request exceeds any of the configured header limits, the associated HTTP/2 stream is not reset until all headers hav...
Astra Linux – Vulnerability in Tomcat9
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, or 7.0.0 to 7.0.107, the Tomcat instance was still vulnerable to CVE-2020-9494, even when using a configuration edge case that was highly unlikely to be used. It should be...
Astra Linux – Vulnerability in Tomcat9
Improper handling of exceptional conditions, and uncontrolled resource consumption vulnerabilities in Apache Tomcat. When processing an HTTP/2 stream, Tomcat failed to correctly handle some cases of excessive HTTP headers. This resulted in an incorrect count of active HTTP/2 streams, leading to t...
Astra Linux – Vulnerability in Tomcat9
In some unusual configurations of multipart uploads, an Integer Overflow vulnerability in Apache Tomcat can lead to a Denial-of-Service attack by bypassing size limits. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, and from 9.0.0.M1 throu...
Astra Linux – Vulnerability in Tomcat9
The simplified implementation of blocking reads and writes introduced in Tomcat 10, and backported to Tomcat 9.0.47 and later versions, exposed a long-standing but extremely difficult to trigger concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60, and...
MiracleLinux 9 : tomcat-9.0.117-2.el9_8 (AXSA:2026-1478:06)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1478:06 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache...
SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:3440-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3440-1 advisory. Update to Tomcat 9.0.120: Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass...
CLEANSTART-2026-BZ21136 Security fixes in tomcat9 9.0.63-r0
Package tomcat9 version 9.0.63-r0 fixes 1 vulnerabilities: CVE-2022-29885...
CLEANSTART-2026-NC21185 Security fixes in tomcat9 9.0.115-r0
Package tomcat9 version 9.0.115-r0 fixes 2 vulnerabilities: CVE-2026-32990, ghsa-8mc5-53m5-3qj2...
CLEANSTART-2026-LQ50135 Security fixes in tomcat9 9.0.64-r0
Package tomcat9 version 9.0.64-r0 fixes 1 vulnerabilities: CVE-2022-34305...