Back Linuxsecurity

Oracle Linux 10: ELSA-2025

Linuxsecurity •LinuxSecurity Advisories • December 11, 2025

[1:9.0.87-8.1] - Resolves: RHEL-124497 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91732 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

tomcat9-9.0.87-8.el10_1.1.noarch.rpm tomcat9-admin-webapps-9.0.87-8.el10_1.1.noarch.rpm tomcat9-docs-webapp-9.0.87-8.el10_1.1.noarch.rpm tomcat9-el-3.0-api-9.0.87-8.el10_1.1.noarch.rpm tomcat9-jsp-2.3-api-9.0.87-8.el10_1.1.noarch.rpm tomcat9-lib-9.0.87-8.el10_1.1.noarch.rpm tomcat9-servlet-4.0-api-9.0.87-8.el10_1.1.noarch.rpm tomcat9-webapps-9.0.87-8.el10_1.1.noarch.rpm

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Linux 10: Tomcat Vulnerabilities Addressed in ELSA-2025 Oracle has released an important update for Oracle Linux 10 addressing multiple vulnerabilities in Tomcat. The update resolves issues including directory traversal with possible remote code execution (CVE-2025-55752), rule bypass in the Rewrite Valve (CVE-2025-31651), and a denial of service (CVE-2025-61795). Affected versions include tomcat9-9.0.87-8.el10_1.1 and related packages. 2 sources 18

Extracted Entities

Oracle Linux 10: ELSA-2025

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Platforms (1)