Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-48989

Fixed in a distro release EPSS 4%CVSS 7.5

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Published 2025-08-13 · CVE record · OSV

Products: Apache Software Foundation Apache Tomcat, Siemens SIMATIC CN 4100

Fixed upstream

EcosystemPackageFixed in
Mavenorg.apache.tomcat.embed:tomcat-embed-core11.0.10
Mavenorg.apache.tomcat.embed:tomcat-embed-core10.1.44
Mavenorg.apache.tomcat.embed:tomcat-embed-core9.0.108
Mavenorg.apache.tomcat:tomcat-coyote11.0.10
Mavenorg.apache.tomcat:tomcat-coyote10.1.44
Mavenorg.apache.tomcat:tomcat-coyote9.0.108

Distro releases

ReleasePackageFixed in
AlmaLinux 10tomcat91:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-admin-webapps1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-docs-webapp1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-el-3.0-api1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-jsp-2.3-api1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-lib1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-servlet-4.0-api1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-webapps1:9.0.87-5.el10_0.3
AlmaLinux 8tomcat1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-admin-webapps1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-docs-webapp1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-el-3.0-api1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-lib1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-webapps1:9.0.87-1.el8_10.6
AlmaLinux 9tomcat1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-admin-webapps1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-docs-webapp1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-el-3.0-api1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-jsp-2.3-api1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-lib1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-servlet-4.0-api1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-webapps1:9.0.87-3.el9_6.3
Debian 12tomcat1010.1.52-1~deb12u1
Debian 12tomcat99.0.70-2
Debian 13tomcat1010.1.52-1~deb13u1
Debian 13tomcat1111.0.15-1~deb13u1
Debian 13tomcat99.0.70-2
Debian 14tomcat1010.1.52-1
Debian 14tomcat1111.0.11-1
Debian 14tomcat99.0.70-2
Red Hat Enterprise Linux 10.0tomcat1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-admin-webapps1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-docs-webapp1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-el-5.0-api1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-jsp-3.1-api1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-lib1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-servlet-6.0-api1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-webapps1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat91:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-admin-webapps1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-docs-webapp1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-el-3.0-api1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-jsp-2.3-api1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-lib1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-servlet-4.0-api1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-webapps1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 8tomcat1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-admin-webapps1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-docs-webapp1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-el-3.0-api1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-lib1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-webapps1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 9tomcat1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-admin-webapps1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-docs-webapp1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-el-3.0-api1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-jsp-2.3-api1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-lib1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-servlet-4.0-api1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-webapps1:9.0.87-3.el9_6.3
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-java-jdk110:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-java-jdk80:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-14.redhat_00013.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-14.redhat_00013.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-14.redhat_00013.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-admin-webapps0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-admin-webapps0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-admin-webapps0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-docs-webapp0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-docs-webapp0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-docs-webapp0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-el-5.0-api0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-el-5.0-api0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-el-5.0-api0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-javadoc0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-javadoc0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-javadoc0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jsp-3.1-api0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jsp-3.1-api0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jsp-3.1-api0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-lib0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-lib0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-lib0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-selinux0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-selinux0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-selinux0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-servlet-6.0-api0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-servlet-6.0-api0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-servlet-6.0-api0:10.1.36-8.redhat_00009.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-webapps0:10.1.36-8.redhat_00009.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-webapps0:10.1.36-8.redhat_00009.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-webapps0:10.1.36-8.redhat_00009.1.el9jws
Red Hat rhel e4s 8.8tomcat1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-admin-webapps1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-docs-webapp1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-el-3.0-api1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-jsp-2.3-api1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-lib1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-servlet-4.0-api1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-webapps1:9.0.87-1.el8_8.7
Red Hat rhel e4s 9.2tomcat1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-admin-webapps1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-docs-webapp1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-el-3.0-api1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-jsp-2.3-api1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-lib1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-servlet-4.0-api1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-webapps1:9.0.87-1.el9_2.6
Red Hat rhel eus 9.4tomcat1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-admin-webapps1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-docs-webapp1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-el-3.0-api1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-jsp-2.3-api1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-lib1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-servlet-4.0-api1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-webapps1:9.0.87-1.el9_4.6
Red Hat rhel tus 8.8tomcat1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-admin-webapps1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-docs-webapp1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-el-3.0-api1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-jsp-2.3-api1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-lib1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-servlet-4.0-api1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-webapps1:9.0.87-1.el8_8.7
Rocky Linux 10tomcat1:10.1.36-1.el10_0.2
Rocky Linux 10tomcat91:9.0.87-5.el10_0.3
Rocky Linux 8tomcat1:9.0.87-1.el8_10.6
Rocky Linux 9tomcat1:9.0.87-3.el9_6.3
SUSE Enterprise Storage 7.1tomcat9.0.108-150200.91.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSStomcat9.0.108-150200.91.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat9.0.108-150200.91.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSStomcat9.0.108-150200.91.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat9.0.108-150200.91.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat1010.1.44-150200.5.51.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSStomcat9.0.108-150200.91.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSStomcat1010.1.44-150200.5.51.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP6tomcat9.0.108-150200.91.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP6tomcat1010.1.44-150200.5.51.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP6tomcat1111.0.10-150600.13.9.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7tomcat9.0.108-150200.91.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7tomcat1010.1.44-150200.5.51.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7tomcat1111.0.10-150600.13.9.1
SUSE Linux Enterprise Server 12 SP5-LTSStomcat9.0.115-3.160.1
SUSE Linux Enterprise Server 15 SP3-LTSStomcat9.0.108-150200.91.1
SUSE Linux Enterprise Server 15 SP4-LTSStomcat9.0.108-150200.91.1
SUSE Linux Enterprise Server 15 SP5-LTSStomcat9.0.108-150200.91.1
SUSE Linux Enterprise Server 15 SP5-LTSStomcat1010.1.44-150200.5.51.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5tomcat9.0.115-3.160.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3tomcat9.0.108-150200.91.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4tomcat9.0.108-150200.91.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5tomcat9.0.108-150200.91.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5tomcat1010.1.44-150200.5.51.1
SUSE Manager Server LTS 4.3tomcat9.0.108-150200.91.1
Ubuntu 24.04 LTStomcat10no fix
Ubuntu 25.10tomcat10no fix
Ubuntu 25.10tomcat11no fix
Ubuntu 26.04 LTStomcat10no fix
Ubuntu 26.04 LTStomcat11no fix
Ubuntu 26.10tomcat10no fix
Ubuntu Pro 14.04 LTStomcat6no fix
Ubuntu Pro 18.04 LTStomcat8no fix
Ubuntu Pro 18.04 LTStomcat9no fix
Ubuntu Pro 20.04 LTStomcat9no fix
Ubuntu Pro 22.04 LTStomcat9no fix
openSUSE Leap 15.6tomcat9.0.108-150200.91.1
openSUSE Leap 15.6tomcat1010.1.44-150200.5.51.1
openSUSE Leap 15.6tomcat1111.0.10-150600.13.9.1
openSUSE Tumbleweedtomcat9.0.108-1.1
openSUSE Tumbleweedtomcat1010.1.44-1.1
openSUSE Tumbleweedtomcat1111.0.10-1.1