Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Apache Tomcat Security Update: Potential Remote Code Execution

published 10 months ago

Summary

A security update is available for Apache Tomcat to fix a vulnerability that could allow an attacker to execute malicious code on your server. This affects Tomcat servers that are exposed to the internet, so it's essential to update your Tomcat installation to prevent unauthorized access. Update your Tomcat version as soon as possible to ensure your security.

What to do

Update redhat tomcat to version 1:9.0.87-1.el8_8.8.
Update redhat tomcat-admin-webapps to version 1:9.0.87-1.el8_8.8.
Update redhat tomcat-docs-webapp to version 1:9.0.87-1.el8_8.8.
Update redhat tomcat-el-3.0-api to version 1:9.0.87-1.el8_8.8.
Update redhat tomcat-jsp-2.3-api to version 1:9.0.87-1.el8_8.8.
Update redhat tomcat-lib to version 1:9.0.87-1.el8_8.8.
Update redhat tomcat-servlet-4.0-api to version 1:9.0.87-1.el8_8.8.
Update redhat tomcat-webapps to version 1:9.0.87-1.el8_8.8.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:8.8::appstream	redhat	tomcat	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_e4s:8.8::appstream	redhat	tomcat-admin-webapps	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_e4s:8.8::appstream	redhat	tomcat-docs-webapp	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_e4s:8.8::appstream	redhat	tomcat-el-3.0-api	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_e4s:8.8::appstream	redhat	tomcat-jsp-2.3-api	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_e4s:8.8::appstream	redhat	tomcat-lib	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_e4s:8.8::appstream	redhat	tomcat-servlet-4.0-api	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_e4s:8.8::appstream	redhat	tomcat-webapps	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_tus:8.8::appstream	redhat	tomcat	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_tus:8.8::appstream	redhat	tomcat-admin-webapps	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_tus:8.8::appstream	redhat	tomcat-docs-webapp	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_tus:8.8::appstream	redhat	tomcat-el-3.0-api	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_tus:8.8::appstream	redhat	tomcat-jsp-2.3-api	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_tus:8.8::appstream	redhat	tomcat-lib	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_tus:8.8::appstream	redhat	tomcat-servlet-4.0-api	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8
Red Hat:rhel_tus:8.8::appstream	redhat	tomcat-webapps	< 1:9.0.87-1.el8_8.8 Fix: upgrade to 1:9.0.87-1.el8_8.8

Original advisory text

Red Hat Security Advisory: tomcat security update

References

https://access.redhat.com/errata/RHSA-2025:23045 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2362782 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2406591 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23045.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-31651 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-31651 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-31651 Vendor Advisory
https://lists.apache.org/[email protected] Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-55752 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-55752 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-55752 Vendor Advisory
https://github.com/apache/tomcat/commit/fec06c610ed7466b401e29cc567a58aee5ed826a Third Party Advisory
https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.5 High

Timeline

Published11 Dec 2025

Updated19 Mar 2026

First seen19 Mar 2026

Sources

RHSA-2025:23045 · OSV

Track software like this

Free during beta