Linux · Security advisory · August 22, 2025

ELSA-2025-14179: Security update for 8 packages

ELSA-2025-14179, released August 22, 2025, fixes 6 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.3288
98th percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
tomcatol 101:10.1.36-1.el10_0.2
tomcat-admin-webappsol 101:10.1.36-1.el10_0.2
tomcat-docs-webappol 101:10.1.36-1.el10_0.2
tomcat-el-5.0-apiol 101:10.1.36-1.el10_0.2
tomcat-jsp-3.1-apiol 101:10.1.36-1.el10_0.2
tomcat-libol 101:10.1.36-1.el10_0.2
tomcat-servlet-6.0-apiol 101:10.1.36-1.el10_0.2
tomcat-webappsol 101:10.1.36-1.el10_0.2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2025-48976 libcommons-fileupload-java: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons... 7.5 0.3288 None reported
High CVE-2025-48988 tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... 7.5 0.3043 None reported
High CVE-2025-48989 tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... 7.5 0.0377 None reported
High CVE-2025-49125 tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... 7.5 0.0344 None reported
High CVE-2025-52520 tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... 7.5 0.0220 None reported
High CVE-2025-53506 tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... 7.5 0.0213 None reported
Showing 1 to 6 of 6 1