{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Atlassian heeft kwetsbaarheden verholpen in verschillende producten, welke gebruik maken van Oracle middle-ware producten zoals de Oracle Utilities Application Framework, WebLogic Server, Data Integrator en Business Intelligence Enterprise Edition.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Deze kwetsbaarheden stellen ongeauthenticeerde aanvallers in staat om een denial of service (DoS) of om zich toegang te verschaffen tot gevoelige gegevens.\nEen reeks kwetsbaarheden is afkomstig van diverse Oracle-middleware software, welke in Atlassian-producten is verwerkt. Deze kwetsbaarheden zijn verholpen in de Critical Patch Update van januari 2026 van Oracle en verwerkt in de getroffen Atlassian producten.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Atlassian heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Relative Path Traversal",
        "title": "CWE-23"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Improper Authorization",
        "title": "CWE-285"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
        "title": "CWE-362"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Incomplete Cleanup",
        "title": "CWE-459"
      },
      {
        "category": "general",
        "text": "Improper Restriction of XML External Entity Reference",
        "title": "CWE-611"
      },
      {
        "category": "general",
        "text": "Incorrect Comparison",
        "title": "CWE-697"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Incorrect Authorization",
        "title": "CWE-863"
      },
      {
        "category": "general",
        "text": "Server-Side Request Forgery (SSRF)",
        "title": "CWE-918"
      },
      {
        "category": "general",
        "text": "CWE-937",
        "title": "CWE-937"
      },
      {
        "category": "general",
        "text": "CWE-1035",
        "title": "CWE-1035"
      },
      {
        "category": "general",
        "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
        "title": "CWE-1321"
      },
      {
        "category": "general",
        "text": "Inefficient Regular Expression Complexity",
        "title": "CWE-1333"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://confluence.atlassian.com/security/security-bulletin-january-20-2026-1712324819.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Atlassian producten",
    "tracking": {
      "current_release_date": "2026-01-22T09:03:42.667958Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0034",
      "initial_release_date": "2026-01-22T09:03:42.667958Z",
      "revision_history": [
        {
          "date": "2026-01-22T09:03:42.667958Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Bamboo"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Bitbucket"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "Confluence"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "Crowd Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-5"
                }
              }
            ],
            "category": "product_name",
            "name": "Crucible"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-6"
                }
              }
            ],
            "category": "product_name",
            "name": "Fisheye"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-7"
                }
              }
            ],
            "category": "product_name",
            "name": "Jira"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3807",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "other",
          "text": "Incorrect Comparison",
          "title": "CWE-697"
        },
        {
          "category": "description",
          "text": "Recent updates address critical security vulnerabilities across various software, including Ansible, Node.js, and Golang packages, with significant fixes for ReDoS and sensitive data exposure issues.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2021-3807 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2021/cve-2021-3807.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2021-3807"
    },
    {
      "cve": "CVE-2022-25883",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "description",
          "text": "Multiple versions of the semver package are vulnerable to Regular Expression Denial of Service (ReDoS) through the new Range function, prompting updates in various products to mitigate this risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-25883 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2022/cve-2022-25883.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2022-25883"
    },
    {
      "cve": "CVE-2022-45693",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "Multiple Oracle products, including Utilities Application Framework, WebLogic Server, Data Integrator, and Business Intelligence Enterprise Edition, have vulnerabilities allowing unauthenticated denial of service attacks, all with a CVSS score of 7.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-45693 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2022/cve-2022-45693.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2022-45693"
    },
    {
      "cve": "CVE-2024-21538",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "description",
          "text": "Recent updates across various AWS packages, Node.js versions, and Python libraries address security vulnerabilities, enhance functionality, and improve performance, while several vulnerability reports highlight critical issues in Oracle Communications, HPE Unified OSS Console, and the cross-spawn package.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21538 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-21538.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2024-21538"
    },
    {
      "cve": "CVE-2024-38286",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "Apache Tomcat versions 11.0.0-M1 to 11.0.0-M20, 10.1.0-M1 to 10.1.24, and 9.0.13 to 9.0.89 are vulnerable to OutOfMemoryError and Denial of Service due to improper TLS handshake handling.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38286 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-38286.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2024-38286"
    },
    {
      "cve": "CVE-2024-45296",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in the path-to-regexp library and related components can lead to Denial of Service (DoS) attacks, particularly affecting Node.js applications and IBM App Connect Enterprise due to backtracking regex issues.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45296 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-45296.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2024-45296"
    },
    {
      "cve": "CVE-2024-45801",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "other",
          "text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
          "title": "CWE-1321"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities across Oracle products and DOMPurify allow for data compromise, denial of service, and XSS attacks, with CVSS scores ranging from 6.3 to 7.3.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45801 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-45801.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2024-45801"
    },
    {
      "cve": "CVE-2025-12383",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
          "title": "CWE-362"
        },
        {
          "category": "other",
          "text": "CWE-1035",
          "title": "CWE-1035"
        },
        {
          "category": "other",
          "text": "CWE-937",
          "title": "CWE-937"
        },
        {
          "category": "description",
          "text": "Oracle Database Server versions 23.4.0-23.26.0 have a vulnerability in the Fleet Patching and Provisioning component, while Eclipse Jersey versions 2.45, 3.0.16, and 3.1.9 may ignore critical SSL configurations due to a race condition.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-12383 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-12383.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-12383"
    },
    {
      "cve": "CVE-2025-15284",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "The `qs` module\u0027s `arrayLimit` option is vulnerable to denial-of-service attacks due to its failure to enforce limits for bracket notation, allowing attackers to exploit memory exhaustion.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-15284 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-15284.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-27152",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        },
        {
          "category": "description",
          "text": "Recent vulnerabilities in axios, pgadmin4, and HPE software expose systems to SSRF and credential leakage, particularly through the use of absolute URLs, necessitating updates to mitigate these risks.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-27152 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-27152.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-27152"
    },
    {
      "cve": "CVE-2025-41249",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authorization",
          "title": "CWE-285"
        },
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "other",
          "text": "CWE-1035",
          "title": "CWE-1035"
        },
        {
          "category": "other",
          "text": "CWE-937",
          "title": "CWE-937"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities have been identified in Oracle Financial Services and Retail products, as well as the Spring Framework, allowing unauthorized access to sensitive data and potentially leading to information disclosure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-41249 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-41249.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-41249"
    },
    {
      "cve": "CVE-2025-48976",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "Multiple denial-of-service vulnerabilities have been identified in Oracle Application Testing Suite, Oracle Agile PLM, Apache Commons FileUpload, and HPE IceWall Identity Manager, with CVSS scores of 7.5 for some products.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48976 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48976.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-48976"
    },
    {
      "cve": "CVE-2025-48989",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        },
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "description",
          "text": "Recent updates for Apache Tomcat versions 9, 10, and 11 address the \u0027MadeYouReset\u0027 DoS vulnerability and other issues, with specific versions being susceptible to Denial of Service attacks from malformed client requests.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48989 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48989.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-48989"
    },
    {
      "cve": "CVE-2025-49146",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in the Oracle Enterprise Data Quality product and PostgreSQL JDBC Driver allow unauthorized access and insecure authentication, with CVSS scores indicating significant risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-49146 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-49146.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-49146"
    },
    {
      "cve": "CVE-2025-52434",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
          "title": "CWE-362"
        },
        {
          "category": "description",
          "text": "Apache Tomcat versions 9.0.0.M1 to 9.0.106 have multiple vulnerabilities, including a race condition affecting HTTP/2 connections and denial of service flaws, alongside issues in Oracle Graph Server and HPE Unified OSS Console.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-52434 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-52434.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-52434"
    },
    {
      "cve": "CVE-2025-52999",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affect Oracle Communications Unified Assurance and Oracle Business Intelligence Enterprise Edition, allowing denial of service attacks, while older jackson-core versions are prone to StackoverflowErrors when parsing nested data.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-52999 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-52999.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-52999"
    },
    {
      "cve": "CVE-2025-53689",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "description",
          "text": "Apache Jackrabbit versions prior to 2.23.2 are vulnerable to blind XXE attacks due to an unsecured document build for loading privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53689 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53689.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-53689"
    },
    {
      "cve": "CVE-2025-54988",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "CWE-1035",
          "title": "CWE-1035"
        },
        {
          "category": "other",
          "text": "CWE-937",
          "title": "CWE-937"
        },
        {
          "category": "description",
          "text": "Apache Tika versions 1.13 to 3.2.1 have a critical XXE vulnerability, while Oracle PeopleSoft\u0027s OpenSearch component in versions 8.60 to 8.62 is also affected by an easily exploitable vulnerability.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-54988 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-54988.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-54988"
    },
    {
      "cve": "CVE-2025-55163",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "other",
          "text": "CWE-1035",
          "title": "CWE-1035"
        },
        {
          "category": "other",
          "text": "CWE-937",
          "title": "CWE-937"
        },
        {
          "category": "description",
          "text": "Recent updates to Netty and Oracle Communications products address critical vulnerabilities, including the \u0027MadeYouReset\u0027 attack in HTTP/2, which can lead to denial of service and resource exhaustion.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-55163 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55163.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-55163"
    },
    {
      "cve": "CVE-2025-55752",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "other",
          "text": "Relative Path Traversal",
          "title": "CWE-23"
        },
        {
          "category": "other",
          "text": "CWE-1035",
          "title": "CWE-1035"
        },
        {
          "category": "other",
          "text": "CWE-937",
          "title": "CWE-937"
        },
        {
          "category": "description",
          "text": "Apache Tomcat versions 1.0.0-M1 to 11.0.10 are vulnerable to a directory traversal issue that may allow remote code execution if HTTP PUT requests are enabled, alongside other security vulnerabilities in HPE UOCAM.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-55752 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55752.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-55752"
    },
    {
      "cve": "CVE-2025-64775",
      "cwe": {
        "id": "CWE-459",
        "name": "Incomplete Cleanup"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incomplete Cleanup",
          "title": "CWE-459"
        },
        {
          "category": "other",
          "text": "CWE-1035",
          "title": "CWE-1035"
        },
        {
          "category": "other",
          "text": "CWE-937",
          "title": "CWE-937"
        },
        {
          "category": "description",
          "text": "Apache Struts versions 2.0.0 to 6.7.0 and 7.0.0 to 7.0.3 have a Denial of Service vulnerability due to file leak in multipart request processing, affecting NetApp products.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-64775 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-64775.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-64775"
    },
    {
      "cve": "CVE-2025-66516",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "CWE-1035",
          "title": "CWE-1035"
        },
        {
          "category": "other",
          "text": "CWE-937",
          "title": "CWE-937"
        },
        {
          "category": "description",
          "text": "Apache Tika has multiple critical XML External Entity (XXE) injection vulnerabilities, particularly affecting PDF parsing, allowing remote attackers to exploit crafted documents for sensitive data disclosure and remote code execution.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-66516 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-66516.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-66516"
    },
    {
      "cve": "CVE-2025-9287",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "description",
          "text": "The document outlines a vulnerability in the `create-hash` package due to inadequate input type checks, leading to potential hash state manipulation and security risks, particularly in the `cipher-base` npm package versions up to 1.0.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-9287 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9287.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-9287"
    },
    {
      "cve": "CVE-2025-9288",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "description",
          "text": "The document outlines a vulnerability in `sha.js` versions up to 2.4.11 due to insufficient input type checks, leading to potential denial of service and private key extraction risks.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-9288 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9288.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7"
          ]
        }
      ],
      "title": "CVE-2025-9288"
    },
    {
      "cve": "CVE-2026-21569",
      "notes": [
        {
          "category": "description",
          "text": "A high severity XXE vulnerability in Crowd Data Center and Server version 7.1.0 has a CVSS score of 7.9, allowing authenticated attackers to access sensitive content without user interaction.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21569 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21569.json"
        }
      ],
      "title": "CVE-2026-21569"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "apache-commons-fileupload-1.6.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the apache-commons-fileupload-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15208",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15208-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48976 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48976/"
      }
    ],
    "title": "apache-commons-fileupload-1.6.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-07-03T00:00:00Z",
      "generator": {
        "date": "2025-07-03T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15208-1",
      "initial_release_date": "2025-07-03T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-07-03T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-commons-fileupload-1.6.0-1.1.aarch64",
                "product": {
                  "name": "apache-commons-fileupload-1.6.0-1.1.aarch64",
                  "product_id": "apache-commons-fileupload-1.6.0-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64",
                "product": {
                  "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64",
                  "product_id": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-commons-fileupload-1.6.0-1.1.ppc64le",
                "product": {
                  "name": "apache-commons-fileupload-1.6.0-1.1.ppc64le",
                  "product_id": "apache-commons-fileupload-1.6.0-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le",
                "product": {
                  "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le",
                  "product_id": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-commons-fileupload-1.6.0-1.1.s390x",
                "product": {
                  "name": "apache-commons-fileupload-1.6.0-1.1.s390x",
                  "product_id": "apache-commons-fileupload-1.6.0-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x",
                "product": {
                  "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x",
                  "product_id": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-commons-fileupload-1.6.0-1.1.x86_64",
                "product": {
                  "name": "apache-commons-fileupload-1.6.0-1.1.x86_64",
                  "product_id": "apache-commons-fileupload-1.6.0-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64",
                "product": {
                  "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64",
                  "product_id": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-fileupload-1.6.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.aarch64"
        },
        "product_reference": "apache-commons-fileupload-1.6.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-fileupload-1.6.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.ppc64le"
        },
        "product_reference": "apache-commons-fileupload-1.6.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-fileupload-1.6.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.s390x"
        },
        "product_reference": "apache-commons-fileupload-1.6.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-fileupload-1.6.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.x86_64"
        },
        "product_reference": "apache-commons-fileupload-1.6.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64"
        },
        "product_reference": "apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le"
        },
        "product_reference": "apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.s390x"
        },
        "product_reference": "apache-commons-fileupload-javadoc-1.6.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64"
        },
        "product_reference": "apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-48976",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48976"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.s390x",
          "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.x86_64",
          "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64",
          "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le",
          "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.s390x",
          "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48976",
          "url": "https://www.suse.com/security/cve/CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244657 for CVE-2025-48976",
          "url": "https://bugzilla.suse.com/1244657"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.s390x",
            "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.s390x",
            "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.s390x",
            "openSUSE Tumbleweed:apache-commons-fileupload-1.6.0-1.1.x86_64",
            "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.aarch64",
            "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.ppc64le",
            "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.s390x",
            "openSUSE Tumbleweed:apache-commons-fileupload-javadoc-1.6.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-48976"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat JBoss Web Server 5.8 on Red Hat Enterprise Linux versions 7, 8, and 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.8.5 serves as a replacement for Red Hat JBoss Web Server 5.8.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload [jws-5] (CVE-2025-48988)\n* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-5] (CVE-2025-49125)\n* tomcat: Apache Commons FileUpload DoS via part headers [jws-5] (CVE-2025-48976)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52520)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52434)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:11695",
        "url": "https://access.redhat.com/errata/RHSA-2025:11695"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2373015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015"
      },
      {
        "category": "external",
        "summary": "2373018",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018"
      },
      {
        "category": "external",
        "summary": "2373020",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020"
      },
      {
        "category": "external",
        "summary": "2379374",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374"
      },
      {
        "category": "external",
        "summary": "2379382",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382"
      },
      {
        "category": "external",
        "summary": "2379386",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11695.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update",
    "tracking": {
      "current_release_date": "2026-04-30T13:31:40+00:00",
      "generator": {
        "date": "2026-04-30T13:31:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.7"
        }
      },
      "id": "RHSA-2025:11695",
      "initial_release_date": "2025-07-28T13:54:01+00:00",
      "revision_history": [
        {
          "date": "2025-07-28T13:54:01+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-07-28T13:54:01+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-30T13:31:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
                "product": {
                  "name": "Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
                  "product_id": "7Server-JWS-5.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 5.8 for RHEL 8",
                "product": {
                  "name": "Red Hat JBoss Web Server 5.8 for RHEL 8",
                  "product_id": "8Base-JWS-5.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 5.8 for RHEL 9",
                "product": {
                  "name": "Red Hat JBoss Web Server 5.8 for RHEL 9",
                  "product_id": "9Base-JWS-5.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
                "product": {
                  "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
                  "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el7jws?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
                "product": {
                  "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
                  "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el8jws?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
                "product": {
                  "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
                  "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el9jws?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-java-jdk11@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-java-jdk8@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                "product": {
                  "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_id": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.87-12.redhat_00011.1.el7jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                "product": {
                  "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_id": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.87-12.redhat_00011.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                "product": {
                  "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_id": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.87-12.redhat_00011.1.el9jws?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src"
        },
        "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 7 Server",
          "product_id": "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch"
        },
        "product_reference": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
        "relates_to_product_reference": "7Server-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src"
        },
        "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 8",
          "product_id": "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch"
        },
        "product_reference": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src"
        },
        "product_reference": "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.8 for RHEL 9",
          "product_id": "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        },
        "product_reference": "jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-5.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-48976",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-06-16T16:00:46.319735+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373020"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
          "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
          "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
          "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373020",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12",
          "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/w7dbnfyqn1yc05kbqqbbyct7wbomv7lf",
          "url": "https://lists.apache.org/thread/w7dbnfyqn1yc05kbqqbbyct7wbomv7lf"
        }
      ],
      "release_date": "2025-06-16T15:00:48.140000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:54:01+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11695"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers"
    },
    {
      "cve": "CVE-2025-48988",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-06-16T15:00:56.878149+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat DoS in multipart upload",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
          "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
          "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
          "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18",
          "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18"
        }
      ],
      "release_date": "2025-06-16T14:13:40.457000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:54:01+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11695"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat DoS in multipart upload"
    },
    {
      "cve": "CVE-2025-49125",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "discovery_date": "2025-06-16T15:01:10.747453+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373018"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
          "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
          "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
          "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373018",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk",
          "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk"
        }
      ],
      "release_date": "2025-06-16T14:18:09.610000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:54:01+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11695"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources"
    },
    {
      "cve": "CVE-2025-52434",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2025-07-10T20:01:51.277157+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379382"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
          "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
          "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
          "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379382",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030",
          "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030"
        }
      ],
      "release_date": "2025-07-10T19:03:47.225000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:54:01+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    },
    {
      "cve": "CVE-2025-52520",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2025-07-10T20:01:27.937417+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379374"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
          "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
          "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
          "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379374",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5",
          "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5"
        }
      ],
      "release_date": "2025-07-10T19:05:41.637000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:54:01+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11695"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    },
    {
      "cve": "CVE-2025-53506",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-07-10T20:02:08.548439+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379386"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
          "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
          "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
          "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
          "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379386",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0",
          "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0"
        }
      ],
      "release_date": "2025-07-10T19:14:23.249000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:54:01+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11695"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws.src",
            "7Server-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk11-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-java-jdk8-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "7Server-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el7jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws.src",
            "8Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "8Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el8jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws.src",
            "9Base-JWS-5.8:jws5-tomcat-admin-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-docs-webapp-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-el-3.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-javadoc-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-jsp-2.3-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-lib-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-selinux-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-servlet-4.0-api-0:9.0.87-12.redhat_00011.1.el9jws.noarch",
            "9Base-JWS-5.8:jws5-tomcat-webapps-0:9.0.87-12.redhat_00011.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Web Server 5.8.5 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.8.5 serves as a replacement for Red Hat JBoss Web Server 5.8.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload [jws-5] (CVE-2025-48988)\n* tomcat-catalina: Apache Tomcat: Security constraint bypass for pre/post-resources [jws-5] (CVE-2025-49125)\n* tomcat: Apache Commons FileUpload DoS via part headers [jws-5] (CVE-2025-48976)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52520)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-52434)\n* jws5-tomcat: Apache Tomcat denial of service [jws-5] (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:11696",
        "url": "https://access.redhat.com/errata/RHSA-2025:11696"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2373015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015"
      },
      {
        "category": "external",
        "summary": "2373018",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018"
      },
      {
        "category": "external",
        "summary": "2373020",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020"
      },
      {
        "category": "external",
        "summary": "2379374",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374"
      },
      {
        "category": "external",
        "summary": "2379382",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382"
      },
      {
        "category": "external",
        "summary": "2379386",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11696.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update",
    "tracking": {
      "current_release_date": "2026-04-30T13:31:46+00:00",
      "generator": {
        "date": "2026-04-30T13:31:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.7"
        }
      },
      "id": "RHSA-2025:11696",
      "initial_release_date": "2025-07-28T13:56:27+00:00",
      "revision_history": [
        {
          "date": "2025-07-28T13:56:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-07-28T13:56:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-30T13:31:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 5.8.5",
                "product": {
                  "name": "Red Hat JBoss Web Server 5.8.5",
                  "product_id": "Red Hat JBoss Web Server 5.8.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-48976",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-06-16T16:00:46.319735+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373020"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 5.8.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373020",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373020"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48976",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48976"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12",
          "url": "https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/w7dbnfyqn1yc05kbqqbbyct7wbomv7lf",
          "url": "https://lists.apache.org/thread/w7dbnfyqn1yc05kbqqbbyct7wbomv7lf"
        }
      ],
      "release_date": "2025-06-16T15:00:48.140000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:56:27+00:00",
          "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11696"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers"
    },
    {
      "cve": "CVE-2025-48988",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-06-16T15:00:56.878149+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat DoS in multipart upload",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 5.8.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48988",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18",
          "url": "https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18"
        }
      ],
      "release_date": "2025-06-16T14:13:40.457000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:56:27+00:00",
          "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11696"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat DoS in multipart upload"
    },
    {
      "cve": "CVE-2025-49125",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "discovery_date": "2025-06-16T15:01:10.747453+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373018"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 5.8.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373018",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373018"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49125",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk",
          "url": "https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk"
        }
      ],
      "release_date": "2025-06-16T14:18:09.610000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:56:27+00:00",
          "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11696"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources"
    },
    {
      "cve": "CVE-2025-52434",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2025-07-10T20:01:51.277157+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379382"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 5.8.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379382",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379382"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52434",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030",
          "url": "https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030"
        }
      ],
      "release_date": "2025-07-10T19:03:47.225000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:56:27+00:00",
          "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11696"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    },
    {
      "cve": "CVE-2025-52520",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2025-07-10T20:01:27.937417+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379374"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 5.8.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379374",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379374"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52520",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5",
          "url": "https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5"
        }
      ],
      "release_date": "2025-07-10T19:05:41.637000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:56:27+00:00",
          "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11696"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    },
    {
      "cve": "CVE-2025-53506",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-07-10T20:02:08.548439+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379386"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 5.8.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379386",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53506",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0",
          "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0"
        }
      ],
      "release_date": "2025-07-10T19:14:23.249000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-28T13:56:27+00:00",
          "details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:11696"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Web Server 5.8.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat denial of service"
    }
  ]
}