nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Apache Tomcat CVE-2025-24813 for JIRA Version 9.12.16 .Upgrade to 10.5?

SJ_ywuj1b

We currently have JIRA Software Data Centre Version 9.12.16 and it has Application Server Container Apache Tomcat/9.0.97

A new vulnerability has been raised CVE-2025-24813 for Apache Tomcat

(https://nvd.nist.gov/vuln/detail/CVE-2025-24813)

Since Apache Tomcat is a packaged in Jira where can we find if this vulnerability has been addressed in a newer version say Jira Software 10.5.

Apache Tomcat ( Affects: 9.0.0.M1 to 9.0.98) released a new version 9.0.99 with a fix for the vulnerability. Can we upgrade just the Apache Tomcat in Jira ?

Any advice will be appreciated

Accepted answers

Idan Bidani

It's really disappointing to see the degrading attitude of the responses here. Your question is absolutely important and would benefit others.

In my google and Atlassian's jira and Security Bulletin searches I couldn't find any official Atlassian reference to the CVE-2025-24813 nor if/how it's impacting Jira.
Per https://community.atlassian.com/forums/Jira-Service-Management/Re-Jira-Service-Management-Datacenter-check-for-CVE-2025/qaq-p/2975873/comment-id/202626#M202626 and my personal validation this shouldn't affect Atlassian Jira

I opened an issue asking if Atlassian can publish a page that inform whether a CVE is affecting its platforms? It's useful so every client won't have to research themselves

All comments

SJ_ywuj1b

@[deleted]and your intention to help. But still havent got the answer

I will try to be a better man and surely will ignore your guess work.

SJ_ywuj1b

hi all ,

Since Apache Tomcat is a packaged in Jira where can we find info if this vulnerability CVE-2025-24813 has been addressed in the newer version Jira Software 10.5.

Cant find anything in the release notes ?

unknown

[deleted by author]

unknown

But still haven't got the answer

If you really were a Jira Admin, you would know your organisation has a support contract with Atlassian and can just raise a support request directly with them to get a direct answer about CVE-2025-24813 and whether they yet know if it affects Jira DC v10.5 or not, instead of asking random strangers on the internet.

Idan Bidani

It's really disappointing to see the degrading attitude of the responses here. Your question is absolutely important and would benefit others.

SJ_ywuj1b

Thank you for your kind words and appreciate your advice. This is what a community supposed to do. Help and guide in a civilised way. I am so new to Jira and dont have any admin access. Due to the Tomcat vulnerability, I was looking to find a solution.

Now I can see the new version Jira 10.5 comes with Tomcat 9.0.100 ie the one with the fix. Yes I totally agree if Atlassian published something it will be a good reference. We have plugins as well and now looking into how those will get affected if we upgrade

SJ_ywuj1b

Received a reply for support see below:

this vulnerability affects Tomcat versions up to 9.0.98. The product team confirmed earlier that Jira installation is not affected by this vulnerability because Jira’s Default Servlet does not have write enabled by default, which is one of the conditions for this vulnerability to be exploited.

Jira is not affected by this CVE based off the configuration of Tomcat we’re using. Specifically the readonly flag for DefaultServlet had not been set to false or to an illegal value, so Jira does not meet the requirements stated in the CVE

However, if your internal security team still has concerns, you can consider upgrading Jira to the latest LTS versions, such as 10.3.4. This version includes Tomcat 9.0.100, which is reassuringly not affected by CVE-2025-24813.

SJ_ywuj1b

Please refer my below comments

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

jira-data-center

data-center