CVE-2025-31651

Aliases:GHSA-ff77-26x5-69crBIT-tomcat-2025-31651
Advisory lineage Upstream: 0 Downstream: 30
Modified
Published: 28 Apr 2025, 19:17
Last modified:26 Feb 2026, 18:27

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
0.2% LOW
0% probability +0.08%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Apr 2025, 19:17
Published
Vulnerability first disclosed
26 Feb 2026, 18:27
Last Modified
Vulnerability information updated

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.20%• Percentile: 42%

Techniques & Countermeasures

  • CWE-116•Improper Encoding or Escaping of Output

    The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Affected Systems

  • apache software foundation•apache tomcat

    ≥ 11.0.0-M1, ≤ 11.0.5 | ≥ 10.1.0-M1, ≤ 10.1.39 | ≥ 9.0.0.M1, ≤ 9.0.102 | ≥ 8.5.0, ≤ 8.5.100

  • Unknown•Tomcat

    ≥ 9.0.0, < 9.0.104 | ≥ 10.1.0, < 10.1.40 | ≥ 11.0.0, < 11.0.6

  • org.apache.tomcat•tomcat-catalina

    ≥ 9.0.76, < 9.0.104 | ≥ 10.1.10, < 10.1.40 | ≥ 11.0.0-M2, < 11.0.6 | ≥ 8.5.0, ≤ 8.5.100

  • org.apache.tomcat.embed•tomcat-embed-core

    ≥ 9.0.76, < 9.0.104 | ≥ 10.1.10, < 10.1.40 | ≥ 11.0.0-M2, < 11.0.6 | ≥ 8.5.0, ≤ 8.5.100

References (12)