Apache Tomcat 9.0.0.M1 < 9.0.106 multiple vulnerabilities

Tenable plugin 240060 bundles five CVEs fixed in Apache Tomcat 9.0.106, spanning the full 9.0.0.M1–9.0.105 range (one narrows to 9.0.23+). The headline act is a pair of denial-of-service bugs in multipart upload handling: CVE-2025-48988 (parts count with no cap → heap exhaustion) and CVE-2025-48976 (Commons FileUpload header size limit too generous → same outcome). Both are unauthenticated, network-reachable, and have public PoC exploit scripts targeting Docker lab environments. Alongside them sits CVE-2025-49125, an authentication-bypass via PreResources/PostResources path confusion (CVSS 7.5, no auth, no interaction — but only fires when resources are mounted at non-root paths). CVE-2025-55668 is a session-fixation flaw gated on the non-default rewrite valve *and* a victim click. CVE-2025-49124 is a Windows-installer-only DLL side-loading issue Apache itself rates Low.

The vendor's aggregate HIGH rating is fair and needs no adjustment. The two DoS CVEs carry EPSS scores of 59.5% and 62.7% respectively — both in the 99th percentile — signaling that weaponization is either happening now or imminent. That alone anchors the bundle at HIGH. The auth bypass (CVE-2025-49125) would push toward CRITICAL *if* PreResources/PostResources at non-root were a common deployment pattern, but in practice this is a minority configuration. The session-fixation and installer bugs are low-friction additions that don't move the needle on their own.

Sources.

1. Tenable Plugin 240060
2. Apache Tomcat 9 Security Advisories
3. CVE-2025-49125 GitHub Advisory
4. CVE-2025-48988 Apache Mailing List
5. CVE-2025-55668 oss-security Disclosure
6. FIRST EPSS API Data
7. gregk4sec CVE-2025-49125 PoC
8. gregk4sec CVE-2025-55668 PoC

Run this script on each Tomcat host (or from an auditor workstation with SSH access). Invoke as: bash check_tomcat_240060.sh /opt/tomcat (pass the Tomcat installation directory as the first argument). Requires read access to the Tomcat lib/ directory. No root required.

#!/usr/bin/env bash
# check_tomcat_240060.sh — Verify Apache Tomcat patched for Tenable plugin 240060
# Usage: bash check_tomcat_240060.sh /path/to/tomcat
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-}"
if [[ -z "$CATALINA_HOME" ]]; then
  echo "UNKNOWN — Usage: $0 /path/to/tomcat"
  exit 2
fi

# Try version.sh first
if [[ -x "$CATALINA_HOME/bin/version.sh" ]]; then
  VERSION=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | grep -oP 'Server number:\s*\K[0-9]+\.[0-9]+\.[0-9]+' || true)
fi

# Fallback: parse catalina.jar MANIFEST
if [[ -z "${VERSION:-}" ]]; then
  JAR=$(find "$CATALINA_HOME/lib" -name 'catalina.jar' -print -quit 2>/dev/null || true)
  if [[ -n "$JAR" ]]; then
    VERSION=$(unzip -p "$JAR" META-INF/MANIFEST.MF 2>/dev/null | grep -oP 'Implementation-Version:\s*\K[0-9]+\.[0-9]+\.[0-9]+' || true)
  fi
fi

if [[ -z "${VERSION:-}" ]]; then
  echo "UNKNOWN — Could not determine Tomcat version in $CATALINA_HOME"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Compare version — fixed in 9.0.106
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

if [[ "$MAJOR" -ne 9 ]]; then
  echo "UNKNOWN — This check targets Tomcat 9.x; detected $VERSION"
  exit 2
fi

if [[ "$MINOR" -eq 0 && "$PATCH" -ge 106 ]]; then
  echo "PATCHED — Tomcat $VERSION >= 9.0.106"
  exit 0
else
  echo "VULNERABLE — Tomcat $VERSION < 9.0.106 (affected by CVE-2025-49125, CVE-2025-48988, CVE-2025-48976, CVE-2025-55668, CVE-2025-49124)"
  exit 1
fi