Apache Tomcat 9.0.0.M1 < 9.0.106 multiple vulnerabilities

Tenable plugin 240060 bundles five CVEs fixed in Apache Tomcat 9.0.106, spanning the full 9.0.0.M1–9.0.105 range (one narrows to 9.0.23+). The headline act is a pair of denial-of-service bugs in multipart upload handling: CVE-2025-48988 (parts count with no cap → heap exhaustion) and CVE-2025-48976 (Commons FileUpload header size limit too generous → same outcome). Both are unauthenticated, network-reachable, and have public PoC exploit scripts targeting Docker lab environments. Alongside them sits CVE-2025-49125, an authentication-bypass via PreResources/PostResources path confusion (CVSS 7.5, no auth, no interaction — but only fires when resources are mounted at non-root paths). CVE-2025-55668 is a session-fixation flaw gated on the non-default rewrite valve *and* a victim click. CVE-2025-49124 is a Windows-installer-only DLL side-loading issue Apache itself rates Low.

The vendor's aggregate HIGH rating is fair and needs no adjustment. The two DoS CVEs carry EPSS scores of 59.5% and 62.7% respectively — both in the 99th percentile — signaling that weaponization is either happening now or imminent. That alone anchors the bundle at HIGH. The auth bypass (CVE-2025-49125) would push toward CRITICAL *if* PreResources/PostResources at non-root were a common deployment pattern, but in practice this is a minority configuration. The session-fixation and installer bugs are low-friction additions that don't move the needle on their own.

Why this verdict

• EPSS signal is loud: Both DoS CVEs sit above 59% EPSS / 99th percentile. This is the strongest statistical predictor of near-term exploitation available. Public PoC scripts lower the bar further.
• Unauthenticated, network-reachable DoS: CVE-2025-48988 and CVE-2025-48976 require only the ability to POST multipart data to any upload-capable endpoint — a condition met by the vast majority of Tomcat deployments. No credentials, no user interaction, no non-default config.
• Auth bypass gated on non-default config: CVE-2025-49125 is a serious flaw (CVSS 7.5, no auth, no interaction) but only fires when PreResources/PostResources are mounted at non-root paths. This is a minority configuration pattern, applying downward pressure that prevents escalation to CRITICAL.
• Role multiplier: Tomcat is a *typical-role* component (line-of-business Java app server) in most environments. In high-value roles — e.g., Tomcat embedded in Jenkins, Atlassian products, or custom identity apps — the auth bypass could yield access to sensitive admin interfaces or CI/CD pipelines. However, the auth bypass requires the non-default PreResources config even in those roles, and the DoS CVEs cap out at availability impact (no code execution, no data exfil). The worst plausible high-value-role outcome is service disruption of a critical application tier, not fleet compromise or domain takeover. This keeps the floor at HIGH, not CRITICAL.
• Session fixation and installer flaws add marginal risk: CVE-2025-55668 requires rewrite valve (non-default) plus victim click. CVE-2025-49124 is install-time Windows-only. Neither moves the needle above HIGH.

Why not higher?

CRITICAL would require either active KEV exploitation, a chain that ends in remote code execution, or a blast radius reaching domain/fleet/supply-chain compromise. None of the five CVEs enable RCE. The auth bypass (the most impactful from a confidentiality standpoint) is gated on a non-default PreResources configuration that limits the reachable population. The DoS pair, while broadly exploitable, caps out at availability impact — it crashes the JVM but does not yield shells or lateral movement.

Why not lower?

MEDIUM would undercount the risk given two CVEs with 99th-percentile EPSS scores, public PoC exploit code, ~100K internet-facing Tomcat instances, and unauthenticated network-reachable attack vectors. The DoS pair alone can take production Java applications offline with a single crafted HTTP request. Downgrading past HIGH without evidence that the population is materially shielded (e.g., <1% exposed) is not defensible when Shodan shows 100K exposed hosts.

1. Set maxPartCount and maxPartHeaderSize on the Tomcat Connector — Directly mitigates CVE-2025-48988 and CVE-2025-48976 without a full upgrade. Set maxPartCount="10" and maxPartHeaderSize="512" in your <Connector> element in server.xml. These are the new defaults in 9.0.106. Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Enforce multipart request body-size limits at the WAF or reverse proxy — Configure your WAF (ModSecurity, AWS WAF, Cloudflare) or reverse proxy (nginx client_max_body_size, Apache LimitRequestBody) to cap multipart request sizes and part counts. This blocks the DoS payload before it reaches Tomcat.
3. Audit and remove non-root PreResources/PostResources mounts — If you don't need PreResources or PostResources at non-root paths, remove them from context.xml to eliminate the CVE-2025-49125 attack surface entirely. If needed, ensure <security-constraint> definitions cover both the expected and alternate access paths.
4. Disable the rewrite valve if not actively used — Remove or comment out the RewriteValve from your Tomcat pipeline configuration if URL rewriting is handled upstream (nginx, Apache httpd, CDN). This eliminates CVE-2025-55668.
5. Rate-limit POST requests to upload endpoints — Apply rate limiting at the load balancer or WAF layer for POST requests with Content-Type: multipart/form-data. This reduces the effectiveness of the DoS exploit even if Tomcat connector limits are not yet tuned.

Run this script on each Tomcat host (or from an auditor workstation with SSH access). Invoke as: bash check_tomcat_240060.sh /opt/tomcat (pass the Tomcat installation directory as the first argument). Requires read access to the Tomcat lib/ directory. No root required.

#!/usr/bin/env bash
# check_tomcat_240060.sh — Verify Apache Tomcat patched for Tenable plugin 240060
# Usage: bash check_tomcat_240060.sh /path/to/tomcat
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-}"
if [[ -z "$CATALINA_HOME" ]]; then
  echo "UNKNOWN — Usage: $0 /path/to/tomcat"
  exit 2
fi

# Try version.sh first
if [[ -x "$CATALINA_HOME/bin/version.sh" ]]; then
  VERSION=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | grep -oP 'Server number:\s*\K[0-9]+\.[0-9]+\.[0-9]+' || true)
fi

# Fallback: parse catalina.jar MANIFEST
if [[ -z "${VERSION:-}" ]]; then
  JAR=$(find "$CATALINA_HOME/lib" -name 'catalina.jar' -print -quit 2>/dev/null || true)
  if [[ -n "$JAR" ]]; then
    VERSION=$(unzip -p "$JAR" META-INF/MANIFEST.MF 2>/dev/null | grep -oP 'Implementation-Version:\s*\K[0-9]+\.[0-9]+\.[0-9]+' || true)
  fi
fi

if [[ -z "${VERSION:-}" ]]; then
  echo "UNKNOWN — Could not determine Tomcat version in $CATALINA_HOME"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Compare version — fixed in 9.0.106
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

if [[ "$MAJOR" -ne 9 ]]; then
  echo "UNKNOWN — This check targets Tomcat 9.x; detected $VERSION"
  exit 2
fi

if [[ "$MINOR" -eq 0 && "$PATCH" -ge 106 ]]; then
  echo "PATCHED — Tomcat $VERSION >= 9.0.106"
  exit 0
else
  echo "VULNERABLE — Tomcat $VERSION < 9.0.106 (affected by CVE-2025-49125, CVE-2025-48988, CVE-2025-48976, CVE-2025-55668, CVE-2025-49124)"
  exit 1
fi

Sources

1. Tenable Plugin 240060
2. Apache Tomcat 9 Security Advisories
3. CVE-2025-49125 GitHub Advisory
4. CVE-2025-48988 Apache Mailing List
5. CVE-2025-55668 oss-security Disclosure
6. FIRST EPSS API Data
7. gregk4sec CVE-2025-49125 PoC
8. gregk4sec CVE-2025-55668 PoC