FINERACT-2421: Bump - org.apache.tomcat.embed:tomcat-embed-core CVE-2025-61795

Aman-Mittal · adamsaghy · commit 433959c28057 · 2026-02-02T19:26:03.000+01:00
diff --git a/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle b/buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle
@@ -279,5 +279,9 @@ dependencyManagement {
         dependency 'io.netty:netty-codec-http:4.1.129.Final'
         // Force lz4-java version: CVE-2025-12183
         dependency 'at.yawk.lz4:lz4-java:1.10.1'
+        // Force tomcat-embed-core version: CVE-2025-24813
+        dependency 'org.apache.tomcat.embed:tomcat-embed-core:10.1.47'
+        dependency 'org.apache.tomcat.embed:tomcat-embed-el:10.1.47'
+        dependency 'org.apache.tomcat.embed:tomcat-embed-websocket:10.1.47'
     }
 }
diff --git a/integration-tests/dependencies.gradle b/integration-tests/dependencies.gradle
@@ -20,7 +20,7 @@ dependencies {
     // testCompile dependencies are ONLY used in src/test, not src/main.
     // Do NOT repeat dependencies which are ALREADY in implementation or runtimeOnly!
     //
-    tomcat 'org.apache.tomcat:tomcat:10.1.45@zip'
+    tomcat 'org.apache.tomcat:tomcat:10.1.47@zip'
     def providerMainOutput = project(':fineract-provider').extensions.getByType(SourceSetContainer).named('main').get().output
     testImplementation( providerMainOutput,
             project(path: ':fineract-core', configuration: 'runtimeElements'),
diff --git a/oauth2-tests/dependencies.gradle b/oauth2-tests/dependencies.gradle
@@ -20,7 +20,7 @@ dependencies {
     // testCompile dependencies are ONLY used in src/test, not src/main.
     // Do NOT repeat dependencies which are ALREADY in implementation or runtimeOnly!
     //
-    tomcat 'org.apache.tomcat:tomcat:10.1.45@zip'
+    tomcat 'org.apache.tomcat:tomcat:10.1.47@zip'
     testImplementation( files("$rootDir/fineract-provider/build/classes/java/main/"),
             project(path: ':fineract-provider', configuration: 'runtimeElements'),
             'org.junit.jupiter:junit-jupiter-api',
diff --git a/twofactor-tests/dependencies.gradle b/twofactor-tests/dependencies.gradle
@@ -20,7 +20,7 @@ dependencies {
     // testCompile dependencies are ONLY used in src/test, not src/main.
     // Do NOT repeat dependencies which are ALREADY in implementation or runtimeOnly!
     //
-    tomcat 'org.apache.tomcat:tomcat:10.1.45@zip'
+    tomcat 'org.apache.tomcat:tomcat:10.1.47@zip'
     testImplementation( files("$rootDir/fineract-provider/build/classes/java/main/"),
             project(path: ':fineract-provider', configuration: 'runtimeElements'),
             'org.junit.jupiter:junit-jupiter-api',

Original file line number	Diff line number	Diff line change
`@@ -279,5 +279,9 @@ dependencyManagement {`
`279`	`279`	`dependency 'io.netty:netty-codec-http:4.1.129.Final'`
`280`	`280`	`// Force lz4-java version: CVE-2025-12183`
`281`	`281`	`dependency 'at.yawk.lz4:lz4-java:1.10.1'`
	`282`	`+ // Force tomcat-embed-core version: CVE-2025-24813`
	`283`	`+ dependency 'org.apache.tomcat.embed:tomcat-embed-core:10.1.47'`
	`284`	`+ dependency 'org.apache.tomcat.embed:tomcat-embed-el:10.1.47'`
	`285`	`+ dependency 'org.apache.tomcat.embed:tomcat-embed-websocket:10.1.47'`
`282`	`286`	`}`
`283`	`287`	`}`