Database Management

Why SolarWinds DPA is not affected by CVE-2025-66614, CVE-2026-24733, CVE-2026-24734

This article explains why SolarWinds Database Performance Analyzer (DPA) is not affected by CVE-2025-66614, CVE-2026-24733, CVE-2026-24734.

First published date

4/20/2026 9:24 PM

Last published date

4/20/2026 9:24 PM

Overview

In 2026, the following security bulletins were released to address vulnerabilities in Apache Tomcat:

Product section

Database Performance Analyzer

Cause

CVE-2025-66614, CVE-2026-24733, CVE-2026-24734

Resolution

  1. CVE-2026-24734: This vulnerability requires an OCSP responder to be used with Tomcat Native or FFM-based SSL for certificate revocation checking, which DPA does not use. DPA uses standard JSSE with a PKCS12 keystore.
  2. CVE-2026-24733: Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, an attacker could bypass that constraint by sending an invalid HEAD request using HTTP/0.9.
    DPA never creates a scenario where HEAD is permitted, but GET is denied, so the HTTP/0.9 bypass has no target constraint to exploit. HEAD method is not specified anywhere in DPA.
  3. CVE-2025-66614: Multiple SSLHostConfigs, one with clientAuth and one without, then only the application is exploitable, and this condition is not being matched with default installation of DPA. There is no second virtual host with differing client cert requirements, so the SNI mismatch attack has nothing to exploit.