Back Linuxsecurity

Oracle Linux 10: Tomcat Important Risk Update ELSA-2025

Linuxsecurity •LinuxSecurity Advisories • December 12, 2025

[1:10.1.36-3.1] - Resolves: RHEL-124494 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91729 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) - Resolves: RHEL-132527 tomcat: Denial of service (CVE-2025-61795)

tomcat-10.1.36-3.el10_1.1.noarch.rpm tomcat-admin-webapps-10.1.36-3.el10_1.1.noarch.rpm tomcat-docs-webapp-10.1.36-3.el10_1.1.noarch.rpm tomcat-el-5.0-api-10.1.36-3.el10_1.1.noarch.rpm tomcat-jsp-3.1-api-10.1.36-3.el10_1.1.noarch.rpm tomcat-lib-10.1.36-3.el10_1.1.noarch.rpm tomcat-servlet-6.0-api-10.1.36-3.el10_1.1.noarch.rpm tomcat-webapps-10.1.36-3.el10_1.1.noarch.rpm

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Linux 10: Tomcat Vulnerabilities Addressed in ELSA-2025 Oracle has released an important update for Oracle Linux 10 addressing multiple vulnerabilities in Tomcat. The update resolves issues including directory traversal with possible remote code execution (CVE-2025-55752), rule bypass in the Rewrite Valve (CVE-2025-31651), and a denial of service (CVE-2025-61795). Affected versions include tomcat9-9.0.87-8.el10_1.1 and related packages. 2 sources 18

Extracted Entities

Oracle Linux 10: Tomcat Important Risk Update ELSA-2025

The full story

Extracted Entities

Attack Types (1)

CVEs (3)

Platforms (2)