critical
CVE-2025-31651
tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA2.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Red Hat5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, Photon OS. Rated lower by AlmaLinux (high), Amazon (high), Oracle (high), Rocky Linux (high), Ubuntu (medium), GHSA (low), Red Hat (low).
Description
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | tomcat | 9.0.104, 10.1.40, 11.0.6 |
| Photon OS 4.0 | apache-tomcat9, apache-tomcat9-webapps | 9.0.104-1.ph4 |
| Photon OS 5.0 | apache-tomcat10, apache-tomcat10-webapps, apache-tomcat9 and 1 more | 10.1.40-1.ph5 and 1 more |
| alma 10 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 13 more | 1:10.1.36-3.el10_1.1 and 1 more |
| alma 8 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more | 1:9.0.87-1.el8_10.7 |
| alma 9 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more | 1:9.0.87-6.el9_7.1 |
| amazon linux 2023 | tomcat10, tomcat10-admin-webapps, tomcat10-docs-webapp and 13 more | 1:10.1.40-1.amzn2023.0.1 and 1 more |
| chainguard | camunda-zeebe-8.6, thingsboard | 8.6.15-r1 and 1 more |
| debian 11 | tomcat9 | 9.0.107-0+deb11u1 |
| debian 12 | tomcat10, tomcat9 | 10.1.40-1 and 1 more |
| debian 13 | tomcat10, tomcat11, tomcat9 | 10.1.40-1 and 2 more |
| debian 14 | tomcat10, tomcat11, tomcat9 | 10.1.40-1 and 2 more |
Show all 189 entries from 36 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | tomcat | 9.0.104, 10.1.40, 11.0.6 |
| Photon OS 4.0 | apache-tomcat9 | 9.0.104-1.ph4 |
| Photon OS 4.0 | apache-tomcat9-webapps | 9.0.104-1.ph4 |
| Photon OS 5.0 | apache-tomcat10 | 10.1.40-1.ph5 |
| Photon OS 5.0 | apache-tomcat10-webapps | 10.1.40-1.ph5 |
| Photon OS 5.0 | apache-tomcat9 | 9.0.104-1.ph5 |
| Photon OS 5.0 | apache-tomcat9-webapps | 9.0.104-1.ph5 |
| alma 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-el-5.0-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-jsp-3.1-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-servlet-6.0-api | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| alma 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-el-3.0-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-jsp-2.3-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-servlet-4.0-api | 1:9.0.87-8.el10_1.1 |
| alma 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| alma 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| alma 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| alma 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| alma 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| amazon linux 2023 | tomcat10 | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-admin-webapps | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-docs-webapp | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-el-5.0-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-jsp-3.1-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-lib | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-servlet-6.0-api | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat10-webapps | 1:10.1.40-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9 | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-admin-webapps | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-docs-webapp | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-el-3.0-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-jsp-2.3-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-lib | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-servlet-4.0-api | 1:9.0.104-1.amzn2023.0.1 |
| amazon linux 2023 | tomcat9-webapps | 1:9.0.104-1.amzn2023.0.1 |
| chainguard | camunda-zeebe-8.6 | 8.6.15-r1 |
| chainguard | thingsboard | 4.0.1-r1 |
| debian 11 | tomcat9 | 9.0.107-0+deb11u1 |
| debian 12 | tomcat10 | 10.1.40-1 |
| debian 12 | tomcat9 | 9.0.70-2 |
| debian 13 | tomcat10 | 10.1.40-1 |
| debian 13 | tomcat11 | 11.0.6-1 |
| debian 13 | tomcat9 | 9.0.70-2 |
| debian 14 | tomcat10 | 10.1.40-1 |
| debian 14 | tomcat11 | 11.0.6-1 |
| debian 14 | tomcat9 | 9.0.70-2 |
| echo | tomcat10 | 10.1.40-1 |
| echo | tomcat11 | 11.0.6-1 |
| echo | tomcat9 | 9.0.70-2 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.104, 10.1.40, 11.0.6 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 9.0.104, 10.1.40, 11.0.6 |
| Oracle Linux 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| Oracle Linux 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| Oracle Linux 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort amazon linux 2023 | tomcat10 | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-admin-webapps | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-docs-webapp | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-lib | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat10-webapps | 1:10.1.40-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9 | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-admin-webapps | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-docs-webapp | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-lib | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | tomcat9-webapps | 1:9.0.104-1.amzn2023.0.1 |
| rapidfort debian 12 | tomcat10 | 0:10.1.40-1 |
| rapidfort debian 12 | tomcat9 | 0:9.0.107-0+deb11u1 |
| rapidfort debian 13 | tomcat10 | 0:10.1.40-1 |
| rapidfort debian 13 | tomcat9 | 0:9.0.107-0+deb11u1 |
| rapidfort Oracle Linux 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| rapidfort Oracle Linux 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| rapidfort Oracle Linux 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| rapidfort rocky 9 | pki-servlet-engine | 1:9.0.50-1.el9_2.3 |
| rapidfort ubuntu 20.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 20.04 | tomcat9 | 0:9.0.70-2 |
| rapidfort ubuntu 22.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 22.04 | tomcat9 | 0:9.0.70-2 |
| rapidfort ubuntu 24.04 | tomcat10 | 0:10.1.55-1ubuntu2~26.04.1 |
| rapidfort ubuntu 24.04 | tomcat9 | 0:9.0.70-2 |
| Red Hat | jws5-tomcat | no fix listed |
| Red Hat | pki-deps:10.6::pki-servlet-4.0-api | no fix listed |
| Red Hat | pki-deps:10.6::pki-servlet-engine | no fix listed |
| Red Hat | pki-servlet-4.0-api | no fix listed |
| Red Hat | pki-servlet-engine | no fix listed |
| Red Hat | tomcat | no fix listed |
| Red Hat | tomcat-admin-webapps | no fix listed |
| Red Hat | tomcat-docs-webapp | no fix listed |
| Red Hat | tomcat-el-2.2-api | no fix listed |
| Red Hat | tomcat-javadoc | no fix listed |
| Red Hat | tomcat-jsp-2.2-api | no fix listed |
| Red Hat | tomcat-jsvc | no fix listed |
| Red Hat | tomcat-lib | no fix listed |
| Red Hat | tomcat-servlet-3.0-api | no fix listed |
| Red Hat | tomcat-webapps | no fix listed |
| Red Hat | tomcat6 | no fix listed |
| Red Hat | tomcat6-admin-webapps | no fix listed |
| Red Hat | tomcat6-docs-webapp | no fix listed |
| Red Hat | tomcat6-el-2.1-api | no fix listed |
| Red Hat | tomcat6-javadoc | no fix listed |
| Red Hat | tomcat6-jsp-2.1-api | no fix listed |
| Red Hat | tomcat6-lib | no fix listed |
| Red Hat | tomcat6-log4j | no fix listed |
| Red Hat | tomcat6-servlet-2.5-api | no fix listed |
| Red Hat | tomcat6-webapps | no fix listed |
| rocky 10 | tomcat | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-admin-webapps | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-docs-webapp | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-el-5.0-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-jsp-3.1-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-lib | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-servlet-6.0-api | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat-webapps | 1:10.1.36-3.el10_1.1 |
| rocky 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-el-3.0-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-jsp-2.3-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-servlet-4.0-api | 1:9.0.87-8.el10_1.1 |
| rocky 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
| rocky 8 | tomcat | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-lib | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.7 |
| rocky 8 | tomcat-webapps | 1:9.0.87-1.el8_10.7 |
| rocky 9 | tomcat | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-admin-webapps | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-docs-webapp | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-el-3.0-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-jsp-2.3-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-lib | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-servlet-4.0-api | 1:9.0.87-6.el9_7.1 |
| rocky 9 | tomcat-webapps | 1:9.0.87-6.el9_7.1 |
| seal maven::Seal Security Database | org.apache.tomcat.embed:tomcat-embed-core | 10.1.10+sp2, 10.1.11+sp999, 10.1.16+sp2, 10.1.19+sp2, 10.1.20+sp2, 10.1.26+sp2, 10.1.28+sp2, 10.1.30+sp2, 10.1.34+sp2, 9.0.80+sp2, 9.0.86+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.apache.tomcat.embed:tomcat-embed-core | 10.1.10+sp999, 10.1.11+sp999, 10.1.16+sp999, 10.1.19+sp999, 10.1.20+sp999, 10.1.26+sp999, 10.1.28+sp999, 10.1.30+sp999, 10.1.34+sp999, 9.0.80+sp999, 9.0.86+sp999 |
| ubuntu 18.04-ESM | tomcat8 | no fix listed |
| ubuntu 18.04-ESM | tomcat9 | no fix listed |
| ubuntu 20.04-ESM | tomcat9 | no fix listed |
| ubuntu 22.04 | tomcat9 | no fix listed |
| ubuntu 24.04 | tomcat10 | no fix listed |
| ubuntu 25.04 | tomcat10 | 10.1.35-1ubuntu0.1 |
| wolfi | thingsboard | 4.0.1-r1 |
References
- http://www.openwall.com/lists/oss-security/2025/04/28/3
- https://access.redhat.com/errata/RHSA-2025:23049
- https://access.redhat.com/security/cve/CVE-2025-31651
- https://bugzilla.redhat.com/2362782
- https://bugzilla.redhat.com/2406591
- https://bugzilla.redhat.com/show_bug.cgi?id=2362782
- https://bugzilla.redhat.com/show_bug.cgi?id=2406591
- https://creativecommons.org/licenses/by/4.0/
All 27 references
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752
- https://errata.almalinux.org/9/ALSA-2025-23049.html
- https://errata.rockylinux.org/RLSA-2025:23049
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/066bf6b6a15a4e7e0941d4acf096841165b97098
- https://github.com/apache/tomcat/commit/175dc75fc428930034a6c93fb52f830d955d8e64
- https://github.com/apache/tomcat/commit/ee3ab548e92345eca0cbd1f01649eb36c6f29454
- https://github.com/apache/tomcat/commit/fbecc915a10c5a3d634c5e2c6ced4ff479ce9953
- https://linux.oracle.com/cve/CVE-2025-31651.html
- https://linux.oracle.com/errata/ELSA-2025-23052.html
- https://lists.apache.org/list.html?announce@tomcat.apache.org
- https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-31651
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- https://ubuntu.com/security/notices/USN-7705-1
- https://www.cve.org/CVERecord?id=CVE-2025-31651