{"cves":["CVE-2025-31650","CVE-2024-56337"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[1:9.0.87-3.el9_6.1]\n- Resolves: RHEL-91765\n  tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)\n- Resolves: RHEL-71981\n  tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)\n\n[1:9.0.87-3]\n- Resolves: RHEL-82945\n  tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n- Resolves: RHEL-71723\n  tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)","id":"ELSA-2025-11335","ovalId":"oval:com.oracle.elsa:def:202511335","source":"oracle_linux","title":"ELSA-2025-11335:  tomcat security update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2025-11335.html"}