critique
CVE-2025-31651
tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA2.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Red Hat5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Bitnami, Photon OS. Plus basse selon AlmaLinux (élevée), Amazon (élevée), Oracle (élevée), Rocky Linux (élevée), Ubuntu (moyenne), GHSA (faible), Red Hat (faible).
Description
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | tomcat | 9.0.104, 10.1.40, 11.0.6 |
| Photon OS 4.0 | apache-tomcat9, apache-tomcat9-webapps | 9.0.104-1.ph4 |
| Photon OS 5.0 | apache-tomcat10, apache-tomcat10-webapps, apache-tomcat9 et 1 autres | 10.1.40-1.ph5 et 1 autres |
| alma 10 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp et 13 autres | 1:10.1.36-3.el10_1.1 et 1 autres |
| alma 8 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp et 5 autres | 1:9.0.87-1.el8_10.7 |
| alma 9 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp et 5 autres | 1:9.0.87-6.el9_7.1 |
| amazon linux 2023 | tomcat10, tomcat10-admin-webapps, tomcat10-docs-webapp et 13 autres | 1:10.1.40-1.amzn2023.0.1 et 1 autres |
| chainguard | camunda-zeebe-8.6, thingsboard | 8.6.15-r1 et 1 autres |
| debian 11 | tomcat9 | 9.0.107-0+deb11u1 |
| debian 12 | tomcat10, tomcat9 | 10.1.40-1 et 1 autres |
| debian 13 | tomcat10, tomcat11, tomcat9 | 10.1.40-1 et 2 autres |
| debian 14 | tomcat10, tomcat11, tomcat9 | 10.1.40-1 et 2 autres |
Afficher les 189 entrées de 36 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | tomcat | 9.0.104, 10.1.40, 11.0.6 |
| Photon OS 4.0 | apache-tomcat9 | 9.0.104-1.ph4 |
| Photon OS 4.0 | apache-tomcat9-webapps | 9.0.104-1.ph4 |
| Photon OS 5.0 | apache-tomcat10 | 10.1.40-1.ph5 |
| Photon OS 5.0 | apache-tomcat10-webapps | 10.1.40-1.ph5 |
| Photon OS 5.0 | apache-tomcat9 | 9.0.104-1.ph5 |
| Photon OS 5.0 | apache-tomcat9-webapps | 9.0.104-1.ph5 |
| alma 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-el-5.0-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-jsp-3.1-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-servlet-6.0-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-el-3.0-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-jsp-2.3-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-servlet-4.0-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| alma 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| alma 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| amazon linux 2023 | tomcat10 | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-admin-webapps | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-docs-webapp | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-el-5.0-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-jsp-3.1-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-lib | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-servlet-6.0-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-webapps | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9 | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-admin-webapps | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-docs-webapp | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-el-3.0-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-jsp-2.3-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-lib | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-servlet-4.0-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-webapps | 1:9.0.104-1.amzn2023.0.1 |
| chainguard | camunda-zeebe-8.6 | 8.6.15-r1 |
| chainguard | thingsboard | 4.0.1-r1 |
| debian 11 | tomcat9 | 9.0.107-0+deb11u1 |
| debian 12 | tomcat10 | 10.1.40-1 |
| debian 12 | tomcat9 | 9.0.70-2 |
| debian 13 | tomcat10 | 10.1.40-1 |
| debian 13 | tomcat11 | 11.0.6-1 |
| debian 13 | tomcat9 | 9.0.70-2 |
| debian 14 | tomcat10 | 10.1.40-1 |
| debian 14 | tomcat11 | 11.0.6-1 |
| debian 14 | tomcat9 | 9.0.70-2 |
| echo | tomcat10 | 10.1.40-1 |
| echo | tomcat11 | 11.0.6-1 |
| echo | tomcat9 | 9.0.70-2 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.104, 10.1.40, 11.0.6 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 9.0.104, 10.1.40, 11.0.6 |
| Oracle Linux 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort amazon linux 2023 | tomcat10 | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-admin-webapps | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-docs-webapp | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-lib | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-webapps | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9 | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-admin-webapps | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-docs-webapp | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-lib | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-webapps | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort debian 12 | tomcat10 | 0:10.1.40-1 |
| rapidfort debian 12 | tomcat9 | 0:9.0.107-0+deb11u1 |
| rapidfort debian 13 | tomcat10 | 0:10.1.40-1 |
| rapidfort debian 13 | tomcat9 | 0:9.0.107-0+deb11u1 |
| rapidfort Oracle Linux 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort rocky 9 | pki-servlet-engine | 1:9.0.50-1.el9_2.3 |
| rapidfort ubuntu 20.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 20.04 | tomcat9 | 0:9.0.70-2 |
| rapidfort ubuntu 22.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 22.04 | tomcat9 | 0:9.0.70-2 |
| rapidfort ubuntu 24.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 24.04 | tomcat9 | 0:9.0.70-2 |
| Red Hat | jws5-tomcat | pas de correctif indiqué |
| Red Hat | pki-deps:10.6::pki-servlet-4.0-api | pas de correctif indiqué |
| Red Hat | pki-deps:10.6::pki-servlet-engine | pas de correctif indiqué |
| Red Hat | pki-servlet-4.0-api | pas de correctif indiqué |
| Red Hat | pki-servlet-engine | pas de correctif indiqué |
| Red Hat | tomcat | pas de correctif indiqué |
| Red Hat | tomcat-admin-webapps | pas de correctif indiqué |
| Red Hat | tomcat-docs-webapp | pas de correctif indiqué |
| Red Hat | tomcat-el-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat-javadoc | pas de correctif indiqué |
| Red Hat | tomcat-jsp-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat-jsvc | pas de correctif indiqué |
| Red Hat | tomcat-lib | pas de correctif indiqué |
| Red Hat | tomcat-servlet-3.0-api | pas de correctif indiqué |
| Red Hat | tomcat-webapps | pas de correctif indiqué |
| Red Hat | tomcat6 | pas de correctif indiqué |
| Red Hat | tomcat6-admin-webapps | pas de correctif indiqué |
| Red Hat | tomcat6-docs-webapp | pas de correctif indiqué |
| Red Hat | tomcat6-el-2.1-api | pas de correctif indiqué |
| Red Hat | tomcat6-javadoc | pas de correctif indiqué |
| Red Hat | tomcat6-jsp-2.1-api | pas de correctif indiqué |
| Red Hat | tomcat6-lib | pas de correctif indiqué |
| Red Hat | tomcat6-log4j | pas de correctif indiqué |
| Red Hat | tomcat6-servlet-2.5-api | pas de correctif indiqué |
| Red Hat | tomcat6-webapps | pas de correctif indiqué |
| rocky 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-el-5.0-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-jsp-3.1-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-servlet-6.0-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-el-3.0-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-jsp-2.3-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-servlet-4.0-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| rocky 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| rocky 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| seal maven::Seal Security Database | org.apache.tomcat.embed:tomcat-embed-core | 10.1.10+sp2, 10.1.11+sp999, 10.1.16+sp2, 10.1.19+sp2, 10.1.20+sp2, 10.1.26+sp2, 10.1.28+sp2, 10.1.30+sp2, 10.1.34+sp2, 9.0.80+sp2, 9.0.86+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.apache.tomcat.embed:tomcat-embed-core | 10.1.10+sp999, 10.1.11+sp999, 10.1.16+sp999, 10.1.19+sp999, 10.1.20+sp999, 10.1.26+sp999, 10.1.28+sp999, 10.1.30+sp999, 10.1.34+sp999, 9.0.80+sp999, 9.0.86+sp999 |
| ubuntu 18.04-ESM | tomcat8 | pas de correctif indiqué |
| ubuntu 18.04-ESM | tomcat9 | pas de correctif indiqué |
| ubuntu 20.04-ESM | tomcat9 | pas de correctif indiqué |
| ubuntu 22.04 | tomcat9 | pas de correctif indiqué |
| ubuntu 24.04 | tomcat10 | pas de correctif indiqué |
| ubuntu 25.04 | tomcat10 | 10.1.35-1ubuntu0.1 |
| wolfi | thingsboard | 4.0.1-r1 |
Références
- http://www.openwall.com/lists/oss-security/2025/04/28/3
- https://access.redhat.com/errata/RHSA-2025:23049
- https://access.redhat.com/security/cve/CVE-2025-31651
- https://bugzilla.redhat.com/2362782
- https://bugzilla.redhat.com/2406591
- https://bugzilla.redhat.com/show_bug.cgi?id=2362782
- https://bugzilla.redhat.com/show_bug.cgi?id=2406591
- https://creativecommons.org/licenses/by/4.0/
Les 27 références
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752
- https://errata.almalinux.org/9/ALSA-2025-23049.html
- https://errata.rockylinux.org/RLSA-2025:23049
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/066bf6b6a15a4e7e0941d4acf096841165b97098
- https://github.com/apache/tomcat/commit/175dc75fc428930034a6c93fb52f830d955d8e64
- https://github.com/apache/tomcat/commit/ee3ab548e92345eca0cbd1f01649eb36c6f29454
- https://github.com/apache/tomcat/commit/fbecc915a10c5a3d634c5e2c6ced4ff479ce9953
- https://linux.oracle.com/cve/CVE-2025-31651.html
- https://linux.oracle.com/errata/ELSA-2025-23052.html
- https://lists.apache.org/list.html?announce@tomcat.apache.org
- https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-31651
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- https://ubuntu.com/security/notices/USN-7705-1
- https://www.cve.org/CVERecord?id=CVE-2025-31651