[FP]: CVE-2025-24813 CVE is still reported in latest Tomcat version

[githubuserVenkat]

Package URl

pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.106

CPE

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.106:::::::*

CVE

CVE-2025-24813

ODC Integration

None

ODC Version

12.1.9

Description

CVE-2025-24813 --> fixed in tomcat version 9.0.99 still showing for 9.0.106

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.apache.tomcat</groupId>
   <artifactId>tomcat-servlet-api</artifactId>
   <version>9.0.106</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #8153
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat/tomcat-servlet-api@.*$</packageUrl>
   <cpe>cpe:/a:apache_tomcat:apache_tomcat</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/19727104091

[chadlwilson]

If you are scanning an entire tomcat distribution zip with the CLI please read the existing issues related to this, emg #8096 (comment)

It is likely your scanning setting is not determining the version numbers correctly. Make sure your Central analyzer is working correctly.

Otherwise please share a log and report in full.