CVE-2025-46701

Description

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
• v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Trends

Current EPSS score: 0.13%• Percentile: 32%

Techniques & Countermeasures

• CWE-178•Improper Handling of Case Sensitivity

  The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Affected Systems

• apache software foundation•apache tomcat

  ≥ 11.0.0-M1, ≤ 11.0.6 | ≥ 10.1.0-M1, ≤ 10.1.40 | ≥ 9.0.0.M1, ≤ 9.0.104 | ≥ 8.5.0, ≤ 8.5.100

• Unknown•Tomcat

  ≥ 9.0.0, < 9.0.105 | ≥ 10.1.0, < 10.1.41 | ≥ 11.0.0, < 11.0.7

• org.apache.tomcat•tomcat-catalina

  ≥ 9.0.0.M1, < 9.0.105 | ≥ 10.1.0-M1, < 10.1.41 | ≥ 11.0.0-M1, < 11.0.7 | ≥ 8.5.0, ≤ 8.5.100

• org.apache.tomcat.embed•tomcat-embed-core

  ≥ 9.0.0.M1, < 9.0.105 | ≥ 10.1.0-M1, < 10.1.41 | ≥ 11.0.0-M1, < 11.0.7 | ≥ 8.5.0, ≤ 8.5.100

References (14)

• https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j
• http://www.openwall.com/lists/oss-security/2025/05/29/4
• https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
• https://nvd.nist.gov/vuln/detail/CVE-2025-46701
• https://github.com/apache/tomcat/commit/0f01966eb60015d975525019e12a087f05ebf01a
• https://github.com/apache/tomcat/commit/238d2aa54b99f91d1111467e2237d2244c64e558
• https://github.com/apache/tomcat/commit/2c6800111e7d8d8d5403c07978ea9bff3db5a5a5
• https://github.com/apache/tomcat/commit/8cb95ff03221067c511b3fa66d4f745bc4b0a605
• https://github.com/apache/tomcat/commit/8df00018a252baa9497615d6420fb6c10466fa74
• https://github.com/apache/tomcat/commit/fab7247d2f0e3a29d5daef565f829f383e10e5e2
• https://github.com/apache/tomcat
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.41
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.7
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.105