Apache Tomcat Server is affected by a vulnerability(CVE-2025-24813) in Sonar 9.9 LTA

SonarQube Server / Community Build
1

Must-share information (formatted with Markdown):

  • which versions are you using (SonarQube Server Community Edition - 9.9 LTA)
  • how is SonarQube deployed: ZIP
  • what are you trying to achieve: Trying to resolve the Vulnerability issue found in the scanning.
  • what have you tried so far to achieve this

**Do not share screenshots of logs –

The version(9.0.85) of Tomcat installed on the remote host is prior to 9.0.99. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.99_security-9 advisory.

Please share the solution or if there is any Latest SonarQube version has the solution to solve this Vulnerability.

2

Hi,

I’ve unlisted your topic since you’re reporting a vulnerability. Our responsible disclosure policy asks that you email security@sonarsource.com rather than making public posts. Could you please re-send this to security@sonarsource.com?