kritisch
CVE-2025-31651
tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA2.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Red Hat5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami, Photon OS. Niedriger laut AlmaLinux (hoch), Amazon (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel), GHSA (niedrig), Red Hat (niedrig).
Beschreibung
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | tomcat | 9.0.104, 10.1.40, 11.0.6 |
| Photon OS 4.0 | apache-tomcat9, apache-tomcat9-webapps | 9.0.104-1.ph4 |
| Photon OS 5.0 | apache-tomcat10, apache-tomcat10-webapps, apache-tomcat9 und 1 weitere | 10.1.40-1.ph5 und 1 weitere |
| alma 10 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp und 13 weitere | 1:10.1.36-3.el10_1.1 und 1 weitere |
| alma 8 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp und 5 weitere | 1:9.0.87-1.el8_10.7 |
| alma 9 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp und 5 weitere | 1:9.0.87-6.el9_7.1 |
| amazon linux 2023 | tomcat10, tomcat10-admin-webapps, tomcat10-docs-webapp und 13 weitere | 1:10.1.40-1.amzn2023.0.1 und 1 weitere |
| chainguard | camunda-zeebe-8.6, thingsboard | 8.6.15-r1 und 1 weitere |
| debian 11 | tomcat9 | 9.0.107-0+deb11u1 |
| debian 12 | tomcat10, tomcat9 | 10.1.40-1 und 1 weitere |
| debian 13 | tomcat10, tomcat11, tomcat9 | 10.1.40-1 und 2 weitere |
| debian 14 | tomcat10, tomcat11, tomcat9 | 10.1.40-1 und 2 weitere |
Alle 189 Einträge aus 36 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | tomcat | 9.0.104, 10.1.40, 11.0.6 |
| Photon OS 4.0 | apache-tomcat9 | 9.0.104-1.ph4 |
| Photon OS 4.0 | apache-tomcat9-webapps | 9.0.104-1.ph4 |
| Photon OS 5.0 | apache-tomcat10 | 10.1.40-1.ph5 |
| Photon OS 5.0 | apache-tomcat10-webapps | 10.1.40-1.ph5 |
| Photon OS 5.0 | apache-tomcat9 | 9.0.104-1.ph5 |
| Photon OS 5.0 | apache-tomcat9-webapps | 9.0.104-1.ph5 |
| alma 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-el-5.0-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-jsp-3.1-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-servlet-6.0-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-el-3.0-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-jsp-2.3-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-servlet-4.0-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| alma 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| alma 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| amazon linux 2023 | tomcat10 | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-admin-webapps | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-docs-webapp | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-el-5.0-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-jsp-3.1-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-lib | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-servlet-6.0-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-webapps | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9 | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-admin-webapps | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-docs-webapp | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-el-3.0-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-jsp-2.3-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-lib | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-servlet-4.0-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-webapps | 1:9.0.104-1.amzn2023.0.1 |
| chainguard | camunda-zeebe-8.6 | 8.6.15-r1 |
| chainguard | thingsboard | 4.0.1-r1 |
| debian 11 | tomcat9 | 9.0.107-0+deb11u1 |
| debian 12 | tomcat10 | 10.1.40-1 |
| debian 12 | tomcat9 | 9.0.70-2 |
| debian 13 | tomcat10 | 10.1.40-1 |
| debian 13 | tomcat11 | 11.0.6-1 |
| debian 13 | tomcat9 | 9.0.70-2 |
| debian 14 | tomcat10 | 10.1.40-1 |
| debian 14 | tomcat11 | 11.0.6-1 |
| debian 14 | tomcat9 | 9.0.70-2 |
| echo | tomcat10 | 10.1.40-1 |
| echo | tomcat11 | 11.0.6-1 |
| echo | tomcat9 | 9.0.70-2 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.104, 10.1.40, 11.0.6 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 9.0.104, 10.1.40, 11.0.6 |
| Oracle Linux 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort amazon linux 2023 | tomcat10 | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-admin-webapps | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-docs-webapp | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-lib | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-webapps | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9 | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-admin-webapps | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-docs-webapp | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-lib | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-webapps | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort debian 12 | tomcat10 | 0:10.1.40-1 |
| rapidfort debian 12 | tomcat9 | 0:9.0.107-0+deb11u1 |
| rapidfort debian 13 | tomcat10 | 0:10.1.40-1 |
| rapidfort debian 13 | tomcat9 | 0:9.0.107-0+deb11u1 |
| rapidfort Oracle Linux 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort rocky 9 | pki-servlet-engine | 1:9.0.50-1.el9_2.3 |
| rapidfort ubuntu 20.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 20.04 | tomcat9 | 0:9.0.70-2 |
| rapidfort ubuntu 22.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 22.04 | tomcat9 | 0:9.0.70-2 |
| rapidfort ubuntu 24.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 24.04 | tomcat9 | 0:9.0.70-2 |
| Red Hat | jws5-tomcat | kein Fix angegeben |
| Red Hat | pki-deps:10.6::pki-servlet-4.0-api | kein Fix angegeben |
| Red Hat | pki-deps:10.6::pki-servlet-engine | kein Fix angegeben |
| Red Hat | pki-servlet-4.0-api | kein Fix angegeben |
| Red Hat | pki-servlet-engine | kein Fix angegeben |
| Red Hat | tomcat | kein Fix angegeben |
| Red Hat | tomcat-admin-webapps | kein Fix angegeben |
| Red Hat | tomcat-docs-webapp | kein Fix angegeben |
| Red Hat | tomcat-el-2.2-api | kein Fix angegeben |
| Red Hat | tomcat-javadoc | kein Fix angegeben |
| Red Hat | tomcat-jsp-2.2-api | kein Fix angegeben |
| Red Hat | tomcat-jsvc | kein Fix angegeben |
| Red Hat | tomcat-lib | kein Fix angegeben |
| Red Hat | tomcat-servlet-3.0-api | kein Fix angegeben |
| Red Hat | tomcat-webapps | kein Fix angegeben |
| Red Hat | tomcat6 | kein Fix angegeben |
| Red Hat | tomcat6-admin-webapps | kein Fix angegeben |
| Red Hat | tomcat6-docs-webapp | kein Fix angegeben |
| Red Hat | tomcat6-el-2.1-api | kein Fix angegeben |
| Red Hat | tomcat6-javadoc | kein Fix angegeben |
| Red Hat | tomcat6-jsp-2.1-api | kein Fix angegeben |
| Red Hat | tomcat6-lib | kein Fix angegeben |
| Red Hat | tomcat6-log4j | kein Fix angegeben |
| Red Hat | tomcat6-servlet-2.5-api | kein Fix angegeben |
| Red Hat | tomcat6-webapps | kein Fix angegeben |
| rocky 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-el-5.0-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-jsp-3.1-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-servlet-6.0-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-el-3.0-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-jsp-2.3-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-servlet-4.0-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| rocky 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| rocky 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| seal maven::Seal Security Database | org.apache.tomcat.embed:tomcat-embed-core | 10.1.10+sp2, 10.1.11+sp999, 10.1.16+sp2, 10.1.19+sp2, 10.1.20+sp2, 10.1.26+sp2, 10.1.28+sp2, 10.1.30+sp2, 10.1.34+sp2, 9.0.80+sp2, 9.0.86+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.apache.tomcat.embed:tomcat-embed-core | 10.1.10+sp999, 10.1.11+sp999, 10.1.16+sp999, 10.1.19+sp999, 10.1.20+sp999, 10.1.26+sp999, 10.1.28+sp999, 10.1.30+sp999, 10.1.34+sp999, 9.0.80+sp999, 9.0.86+sp999 |
| ubuntu 18.04-ESM | tomcat8 | kein Fix angegeben |
| ubuntu 18.04-ESM | tomcat9 | kein Fix angegeben |
| ubuntu 20.04-ESM | tomcat9 | kein Fix angegeben |
| ubuntu 22.04 | tomcat9 | kein Fix angegeben |
| ubuntu 24.04 | tomcat10 | kein Fix angegeben |
| ubuntu 25.04 | tomcat10 | 10.1.35-1ubuntu0.1 |
| wolfi | thingsboard | 4.0.1-r1 |
Referenzen
- http://www.openwall.com/lists/oss-security/2025/04/28/3
- https://access.redhat.com/errata/RHSA-2025:23049
- https://access.redhat.com/security/cve/CVE-2025-31651
- https://bugzilla.redhat.com/2362782
- https://bugzilla.redhat.com/2406591
- https://bugzilla.redhat.com/show_bug.cgi?id=2362782
- https://bugzilla.redhat.com/show_bug.cgi?id=2406591
- https://creativecommons.org/licenses/by/4.0/
Alle 27 Referenzen
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752
- https://errata.almalinux.org/9/ALSA-2025-23049.html
- https://errata.rockylinux.org/RLSA-2025:23049
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/066bf6b6a15a4e7e0941d4acf096841165b97098
- https://github.com/apache/tomcat/commit/175dc75fc428930034a6c93fb52f830d955d8e64
- https://github.com/apache/tomcat/commit/ee3ab548e92345eca0cbd1f01649eb36c6f29454
- https://github.com/apache/tomcat/commit/fbecc915a10c5a3d634c5e2c6ced4ff479ce9953
- https://linux.oracle.com/cve/CVE-2025-31651.html
- https://linux.oracle.com/errata/ELSA-2025-23052.html
- https://lists.apache.org/list.html?announce@tomcat.apache.org
- https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-31651
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- https://ubuntu.com/security/notices/USN-7705-1
- https://www.cve.org/CVERecord?id=CVE-2025-31651