[CVE-2025-55752] HIGH: Apache Tomcat tomcat-embed-core 10.1.35 - Directory traversal with possible RCE

[nthmost-orkes]

Vulnerability Report

Field	Value
CVEs	CVE-2025-48988, CVE-2025-48989, CVE-2025-55752
Severity	HIGH (3 CVEs)
Library	org.apache.tomcat.embed:tomcat-embed-core
Source	workers.jar
Installed Version	10.1.35
Fixed Version	10.1.45+ / 11.0.11+ / 9.0.109+

Summary

Three vulnerabilities in Tomcat embedded core:

1. CVE-2025-48988 - Apache Tomcat DoS in multipart upload
2. CVE-2025-48989 - HTTP/2 "MadeYouReset" DoS attack through HTTP/2 control frames
3. CVE-2025-55752 - Directory traversal via rewrite with possible RCE

References

• CVE-2025-48988
• CVE-2025-48989
• CVE-2025-55752

---

Filed from container vulnerability scan of workers.jar

[nthmost-orkes]

Fix PRs:

• Security: Bump Spring Boot and pin vulnerable transitive dependencies conductor#800 (Spring Boot 3.3.5 -> 3.3.11, updates tomcat-embed-core via BOM)
• Bump Spring Boot from 3.1.4 to 3.3.11 conductor-task-update#1 (Spring Boot 3.1.4 -> 3.3.11)