JMIX 3 - Critical Vulnerability in Tomcat 11.0.24 upgrade to 11.0.25 required

Support
1

Hi Jmix Team,

Our security team inform us that our code has a critical vulnerability, our aplication is using the latest version 3.0.2. The recommended solution is to upgraded the embbebed TOMCAT from 11.0.24 to 11.0.25. We understand that this version come along with the Springboot version, ¿Is there any plan to upgrade the springboot version to a higher version with an upgraded Tomcat?

image
image1531×239 18.7 KB

CVE-2026-65182 (NVD)

National Vulnerability Database

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

4

Hi,

Thanks for reporting.

We regulary upgrade Jmix to a latest relevant version of Spring Boot.

Jmix 3.0.x uses Spring Boot 4.0.x (the latest - 4.0.8). Now it uses Tomcat 11.0.24.
But even the latest pre-release Spring Boot 4.2.0-M1 still uses Tomcat 11.0.24.

So if there will be no Spring Boot version with updated Tomcat - we will update it explicitly.

You also can do it on your project side (if you haven’t done it yet):
Upgrade 3 libraries to make it more consistent.

api 'org.apache.tomcat.embed:tomcat-embed-core:11.0.25'
api 'org.apache.tomcat.embed:tomcat-embed-el:11.0.25'
api 'org.apache.tomcat.embed:tomcat-embed-websocket:11.0.25'

Regards,
Ivan

5

Thanks for the quick reply, your proposal worked.