[Aikido] Fix 37 security issues in tomcat-embed-core, tomcat-coyote, tomcat-catalina and 5 more

[aikido-autofix]

Upgrade Tomcat and Jackson dependencies to fix critical RCE, authentication bypass, and path traversal vulnerabilities in file uploads and JSP compilation.

✅ There are no breaking changes

✅ 47 CVEs resolved by this upgrade, including 7 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-24813	🚨 CRITICAL	[tomcat-embed-core] Path traversal vulnerability in the default servlet with write permissions enabled allows attackers to access sensitive files or execute remote code through partial PUT requests and path equivalence exploitation.
CVE-2026-41293	🚨 CRITICAL	[tomcat-embed-core] Improper input validation vulnerability allows attackers to bypass security controls or trigger unexpected behavior. Potential impacts include remote code execution, denial of service, or information disclosure depending on exploitation context.
CVE-2026-43512	🚨 CRITICAL	[tomcat-embed-core] Digest authentication implementation contains flaws allowing attackers to bypass authentication mechanisms. This vulnerability enables unauthorized access to protected resources without valid credentials.
CVE-2024-50379	🚨 CRITICAL	[tomcat-embed-core] TOCTOU race condition in JSP compilation on case-insensitive filesystems with writable default servlet allows remote code execution. Affects systems with non-default write-enabled servlet configuration.
CVE-2025-31651	🚨 CRITICAL	[tomcat-embed-core] Improper neutralization of escape sequences in rewrite rules allows specially crafted requests to bypass security constraints under specific configurations. This could lead to unauthorized access if rewrite rules enforce security policies.
CVE-2025-55754	🚨 CRITICAL	[tomcat-embed-core] Improper neutralization of ANSI escape sequences in log messages allows attackers to inject sequences via crafted URLs to manipulate console output and clipboard on Windows systems, potentially tricking administrators into executing malicious commands.
CVE-2026-43515	🚨 CRITICAL	[tomcat-embed-core] Improper authorization in method constraints allows attackers to bypass HTTP method restrictions on specific file extensions, potentially enabling unauthorized access to protected resources.
CVE-2025-66614	HIGH	[tomcat-embed-core] Improper validation of SNI extension hostname against HTTP host header allows clients to bypass client certificate authentication by providing mismatched hostnames across multiple virtual hosts. This enables authentication bypass when certificate requirements differ between virtual hosts.
CVE-2025-48988	HIGH	[tomcat-embed-core] Uncontrolled resource allocation vulnerability allowing attackers to exhaust server resources and cause denial of service through unbounded memory or connection consumption.
CVE-2025-55752	HIGH	[tomcat-embed-core] Path traversal vulnerability allowing attackers to bypass security constraints like /WEB-INF/ protection through manipulated rewrite rules. Combined with enabled PUT requests, this could enable remote code execution.
CVE-2025-31650	HIGH	[tomcat-embed-core] Improper input validation in HTTP priority headers causes incomplete request cleanup, leading to memory leaks. Repeated malicious requests can trigger OutOfMemoryException and cause denial of service.
CVE-2024-56337	HIGH	[tomcat-embed-core] A TOCTOU race condition in the default servlet on case-insensitive file systems with write enabled allows attackers to bypass security checks. This incomplete mitigation of CVE-2024-50379 could lead to unauthorized file access or modification.
CVE-2025-55668	MEDIUM	[tomcat-embed-core] Session fixation vulnerability in the rewrite valve allows attackers to hijack user sessions by reusing existing session identifiers, potentially leading to unauthorized access.
CVE-2025-48989	MEDIUM	[tomcat-embed-core] Improper resource shutdown vulnerability allows attackers to exploit the "made you reset" attack, potentially causing denial of service or connection manipulation through improper HTTP connection handling.
CVE-2025-52520	MEDIUM	[tomcat-embed-core] Integer overflow in multipart upload handling allows bypassing size limits, leading to denial of service attacks in specific configurations.
CVE-2026-24734	MEDIUM	[tomcat-embed-core] Improper input validation in OCSP responder handling fails to verify response freshness and completion, allowing certificate revocation to be bypassed. This enables attackers to use revoked certificates for authentication or encryption.
CVE-2026-24880	MEDIUM	[tomcat-embed-core] HTTP request smuggling vulnerability via invalid chunk extension allows attackers to bypass security controls and potentially execute arbitrary code or manipulate request handling.
CVE-2026-34483	MEDIUM	[tomcat-embed-core] Improper encoding in JsonAccessLogValve allows injection of malicious content into JSON access logs, potentially enabling log manipulation and code injection attacks.
CVE-2026-34487	MEDIUM	[tomcat-embed-core] Kubernetes bearer tokens are exposed in log files through the cloud membership clustering component, allowing information disclosure to unauthorized users with log access.
CVE-2026-41284	MEDIUM	[tomcat-embed-core] Uncontrolled resource allocation vulnerability allows attackers to exhaust server resources through unlimited allocation requests, leading to denial of service.
CVE-2026-43513	MEDIUM	[tomcat-embed-core] Improper case sensitivity handling in LockOutRealm allows attackers to bypass account lockout protections through case-variant usernames, potentially enabling unauthorized access.
CVE-2025-49125	MEDIUM	[tomcat-embed-core] Authentication bypass vulnerability allowing access to PreResources/PostResources via alternate paths, bypassing security constraints that protect the expected paths.
CVE-2026-42498	MEDIUM	[tomcat-embed-core] HTTP Authentication headers are exposed to unexpected hosts during WebSocket authentication, allowing potential credential disclosure to unauthorized parties.
CVE-2026-25854	MEDIUM	[tomcat-embed-core] Open redirect vulnerability in LoadBalancerDrainingValve allows attackers to redirect users to untrusted sites. This could enable phishing attacks or malicious redirects to compromise user security.
CVE-2025-61795	MEDIUM	[tomcat-embed-core] Temporary files from multipart uploads aren't cleaned up immediately during errors, allowing disk space to fill faster than garbage collection can clear it, causing denial of service.
CVE-2025-49124	LOW	[tomcat-embed-core] Untrusted search path vulnerability in Windows installer allows arbitrary code execution when icacls.exe is invoked without a full path, enabling privilege escalation during installation.
CVE-2025-53506	LOW	[tomcat-embed-core] An HTTP/2 client that fails to acknowledge initial settings frame can cause uncontrolled resource consumption by bypassing concurrent stream limits. This leads to potential denial of service through resource exhaustion.
CVE-2026-43514	LOW	[tomcat-embed-core] Observable timing discrepancy in AJP secret comparison allows attackers to bypass authentication through timing analysis attacks.
CVE-2025-46701	LOW	[tomcat-embed-core] Improper case sensitivity handling in CGI servlet allows bypass of security constraints applied to URI path components. This enables attackers to circumvent access controls.
GHSA-r7wm-3cxj-wff9	HIGH	[jackson-core] Incomplete fix for number length validation in the async JSON parser allows attackers to bypass maxNumberLength constraints by streaming chunks without terminators, causing unbounded memory accumulation up to maxStringLength (~20MB default) instead of the configured limit (~1KB default). This enables denial-of-service attacks against reactive frameworks through memory exhaustion.
GHSA-72hv-8253-57qq	MEDIUM	[jackson-core] The async JSON parser fails to enforce the maxNumberLength constraint, allowing attackers to send arbitrarily long numbers that bypass validation and cause memory/CPU exhaustion (DoS). The synchronous parser correctly enforces this limit, but the async path skips the validation methods entirely.
AIKIDO-2026-11184	HIGH	[spring-data-commons] A property-lookup cache accepts attacker-supplied strings as permanent cache keys, enabling heap exhaustion denial-of-service attacks through repeated requests. Vulnerable applications use Querydsl web bindings or @ProjectedPayload form-parameter binding that forward unfiltered HTTP-supplied strings to PropertyPath.from.
AIKIDO-2026-11186	LOW	[spring-data-commons] Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.
AIKIDO-2026-11183	LOW	[spring-data-commons] A vulnerability in Spring Data Web Support with @ProjectedPayload allows attackers to trigger excessive memory allocation through specially crafted HTTP requests, causing Denial of Service.
AIKIDO-2026-11185	LOW	[spring-data-commons] A vulnerability allows attackers to trigger a StackOverflowException and cause Denial of Service by crafting malicious Sort parameters. This affects applications that expose endpoints accepting Sort parameters from untrusted sources without sanitization.
AIKIDO-2026-10661	HIGH	[spring-boot] A timing attack vulnerability in DevTools remote secret comparison allows attackers on the same network to infer the secret through repeated measurements, potentially leading to unauthorized class uploads and remote code execution.
CVE-2025-22235	HIGH	[spring-boot] EndpointRequest.to() incorrectly creates a matcher for null/** when the referenced actuator endpoint is disabled or not exposed, potentially allowing unauthorized access to /null paths that should be protected by Spring Security.
AIKIDO-2026-10660	HIGH	[spring-boot] Insecure temporary directory handling allows a local attacker to predict and take control of temp directories without ownership verification. This enables session hijacking or remote code execution when persistent sessions are enabled.
AIKIDO-2026-10581	MEDIUM	[spring-boot] ApplicationPidFileWriter improperly follows symlinks when writing PID files at predictable paths, allowing local attackers with write access to cause arbitrary file corruption on application startup.
AIKIDO-2026-10583	MEDIUM	[spring-boot] A weak pseudo-random number generator is used for ${random.value}, generating predictable values unsuitable for secrets. This can weaken tokens, passwords, and other security-sensitive data derived from these properties.
AIKIDO-2026-10584	MEDIUM	[spring-boot] Improper validation of certificate hostnames in Cassandra auto-configuration allows TLS connections to trust certificates without verifying they match the intended server hostname, enabling man-in-the-middle attacks against Cassandra traffic.
AIKIDO-2026-11158	HIGH	[spring-core] Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
AIKIDO-2026-10571	MEDIUM	[spring-core] Static resource handling on Windows is vulnerable to uncontrolled resource consumption when resolving crafted requests, allowing attackers to exhaust HTTP connections and cause denial of service.
CVE-2026-54512	HIGH	[jackson-databind] Polymorphic type validator bypass allows attackers to deserialize denied classes by hiding them as generic type parameters within allowed container types. This enables remote code execution through instantiation and property population of malicious gadget classes.
CVE-2026-54513	HIGH	[jackson-databind] BasicPolymorphicTypeValidator's allowIfSubTypeIsArray() method fails to validate array component types against the allowlist, allowing deserialization of non-allowlisted types as array elements. This bypasses type validation and enables remote code execution through malicious object instantiation.
CVE-2026-59888	MEDIUM	[jackson-databind] A PropertyNamingStrategy bypass allows @JsonIgnore annotations to be circumvented on Java Records, enabling ignored fields to be populated through renamed JSON keys during deserialization.
CVE-2026-54514	MEDIUM	[jackson-databind] Unsafe DNS resolution occurs during deserialization of InetSocketAddress objects, allowing attackers to trigger arbitrary DNS queries via untrusted JSON input before application validation. This enables DNS-based attacks and information disclosure through timing analysis.

🔗 Related Tasks

• Small upgrade for Apache Tomcat #13

🤖 Remediation details

Bump spring-boot-starter-parent to 3.5.16 to remediate transitive CVEs in Apache Tomcat, Jackson Core, Jackson Databind, Spring Core, Spring Data Commons, and Spring Boot itself in demos/archunit-guardrails/pom.xml.

• Vulnerable packages: org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-websocket, org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-util, com.fasterxml.jackson.core:jackson-core, com.fasterxml.jackson.core:jackson-databind, org.springframework:spring-core, org.springframework.data:spring-data-commons, and Spring Boot itself.
• All are resolved transitively through the spring-boot-starter-parent BOM chain; no direct version declarations or dependencyManagement overrides existed in the project POM, so a single parent version bump is the correct and minimal fix.

org.apache.tomcat.embed:tomcat-embed-core

This artifact is managed transitively via the tomcat.version property in spring-boot-dependencies. The old parent (3.4.0) resolved Tomcat to 10.1.33, which is vulnerable to numerous CVEs spanning partial PUT handling, HTTP/2 header processing, session fixation, and other issues. Bumping spring-boot-starter-parent to 3.5.16 advances tomcat.version to 10.1.55, satisfying the ≥ 10.1.55 patched-version floor required across all listed Tomcat advisories.

org.apache.tomcat.embed:tomcat-embed-websocket

Managed by the same tomcat.version property in spring-boot-dependencies as tomcat-embed-core. The parent bump to 3.5.16 advances this artifact from 10.1.33 to 10.1.55 identically, resolving all applicable Tomcat CVEs for the WebSocket embed module.

org.apache.tomcat:tomcat-coyote

Also governed by tomcat.version in spring-boot-dependencies. Resolved from 10.1.33 to 10.1.55 as a direct consequence of the parent bump to 3.5.16, meeting the patched-version requirement for all listed Tomcat CVEs.

org.apache.tomcat:tomcat-catalina

Governed by the same tomcat.version property. Resolved from 10.1.33 to 10.1.55 via the parent bump to 3.5.16, remediating all applicable Tomcat CVEs for this module.

org.apache.tomcat:tomcat-util

Governed by the same tomcat.version property. Resolved from 10.1.33 to 10.1.55 via the parent bump to 3.5.16, remediating all applicable Tomcat CVEs for this utility module.

com.fasterxml.jackson.core:jackson-core

Jackson artifacts are managed in spring-boot-dependencies via the jackson-bom.version property, which imports com.fasterxml.jackson:jackson-bom. The old parent set jackson-bom.version to 2.18.1, resolving jackson-core at 2.18.1 — below the ≥ 2.18.8 floor required by GHSA-r7wm-3cxj-wff9 and GHSA-72hv-8253-57qq. The parent bump to 3.5.16 advances jackson-bom.version to 2.21.4, which resolves jackson-core at 2.21.4, satisfying all patched-version requirements.

com.fasterxml.jackson.core:jackson-databind

Managed through the same jackson-bom.version / com.fasterxml.jackson:jackson-bom import as jackson-core. The old parent resolved jackson-databind at 2.18.1, below the ≥ 2.18.8 floor required by CVE-2026-54512, CVE-2026-54513, CVE-2026-59888, and CVE-2026-54514. The parent bump to 3.5.16 resolves jackson-databind at 2.21.4 via the updated jackson-bom, satisfying all patched-version requirements.

org.springframework:spring-core

Spring Framework artifacts are managed in spring-boot-dependencies via the spring-framework.version property, which imports org.springframework:spring-framework-bom. The old parent set spring-framework.version to 6.2.0, placing spring-core in the vulnerable range [6.2.0, 6.2.17] for AIKIDO-2026-10571 and [6.2.0, 6.2.18] for AIKIDO-2026-11158. The parent bump to 3.5.16 advances spring-framework.version to 6.2.19, satisfying the ≥ 6.2.19 patched-version floor for both advisories.

org.springframework.data:spring-data-commons

Spring Data artifacts are managed via the spring-data-bom.version property, which imports org.springframework.data:spring-data-bom. The old parent set spring-data-bom.version to 2024.1.0, which resolves spring-data-commons at 3.4.0 — within the vulnerable range [3.4.0, 3.4.14] for AIKIDO-2026-11183, AIKIDO-2026-11184, AIKIDO-2026-11185, and AIKIDO-2026-11186. The parent bump to 3.5.16 advances spring-data-bom.version to 2025.0.13, which resolves spring-data-commons at 3.5.x (≥ 3.4.15), satisfying all patched-version floors.

Spring Boot (spring-boot-starter-parent)

Spring Boot itself is the direct parent POM declared in demos/archunit-guardrails/pom.xml. Version 3.4.0 falls within the vulnerable ranges [3.4.0, 3.4.15] for AIKIDO-2026-10660, AIKIDO-2026-10661, AIKIDO-2026-10581, AIKIDO-2026-10583, AIKIDO-2026-10584, and within [3.4.0, 3.4.4] for CVE-2025-22235. Bumping the declared parent version to 3.5.16 satisfies the ≥ 3.4.16 (and ≥ 3.4.5 for CVE-2025-22235) patched-version floors for all listed Spring Boot advisories, and simultaneously delivers all transitive dependency upgrades described above through the updated BOM.

Version changes

Package	From	To	Why updated
org.springframework.boot:spring-boot-starter-parent	3.4.0	3.5.16	Direct parent bump — fixes Spring Boot CVEs and drives all transitive upgrades below
org.apache.tomcat.embed:tomcat-embed-core	10.1.33	10.1.55	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets tomcat.version=10.1.55)
org.apache.tomcat.embed:tomcat-embed-websocket	10.1.33	10.1.55	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets tomcat.version=10.1.55)
org.apache.tomcat:tomcat-coyote	10.1.33	10.1.55	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets tomcat.version=10.1.55)
org.apache.tomcat:tomcat-catalina	10.1.33	10.1.55	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets tomcat.version=10.1.55)
org.apache.tomcat:tomcat-util	10.1.33	10.1.55	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets tomcat.version=10.1.55)
com.fasterxml.jackson.core:jackson-core	2.18.1	2.21.4	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets jackson-bom.version=2.21.4)
com.fasterxml.jackson.core:jackson-databind	2.18.1	2.21.4	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets jackson-bom.version=2.21.4)
org.springframework:spring-core	6.2.0	6.2.19	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets spring-framework.version=6.2.19)
org.springframework.data:spring-data-commons	3.4.0	3.5.x (via spring-data-bom:2025.0.13)	Transitive after parent bump (spring-boot-dependencies:3.5.16 sets spring-data-bom.version=2025.0.13)