9.6

CVE-2025-55754: Apache Tomcat: console manipulation via escape sequences in log messages

Modified
AliasesUBUNTU-CVE-2025-55754DEBIAN-CVE-2025-55754CGA-2mmj-cq9w-2p7v
Published 27-10-2025Last modified 12-05-2026

Vulnerability summary

CVE-2025-55754 is a critical (CVSS 9.6) vulnerability in apache software foundation apache tomcat. EPSS estimates a 10.17% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.6 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 10% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.6/10
010
Critical · v3.1 (CVE.org)
EPSS score
10.17%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 30 · Related 20
DLA-4468-1DSA-6120-1DSA-6121-1MGASA-2025-0250OPENSUSE-SU-2025:15716-1OPENSUSE-SU-2025:15717-1

Timeline

  1. 27-10-2025
    PublishedVulnerability first disclosed.
  2. 12-05-2026
    Last modifiedVulnerability information updated.

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

10.17%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard15 products
  • camunda-zeebe-8.6< 8.6.29-r2
  • camunda-zeebe-8.6-compat< 8.6.29-r2
  • camunda-zeebe-8.7< 8.7.16-r1
  • camunda-zeebe-8.7-compat< 8.7.16-r1
  • kayenta-2025.0< 2025.0.8-r3
Debian3 products
  • tomcat10< 10.1.52-1~deb12u1 | < 10.1.52-1~deb13u1 | < 10.1.46-1
  • tomcat11< 11.0.15-1~deb13u1 | < 11.0.11-1
  • tomcat9< 9.0.70-2
Ubuntu3 products
  • tomcat10All versions (No fix recorded)
  • tomcat11All versions (No fix recorded)
  • tomcat9All versions (No fix recorded)
Org.apache.tomcat2 products
  • tomcat≥ 11.0.0-M1, < 11.0.11 | ≥ 10.1.0-M1, < 10.1.45 | ≥ 9.0.40, < 9.0.109 | ≥ 8.5.60, ≤ 8.5.100
  • tomcat-catalina≥ 11.0.0-M1, < 11.0.11 | ≥ 10.1.0-M1, < 10.1.45 | ≥ 9.0.40, < 9.0.109 | ≥ 8.5.60, ≤ 8.5.100
Apache1 product
  • tomcat≥ 8.5.60, ≤ 8.5.100 | ≥ 9.0.40, < 9.0.109 | ≥ 10.0.0, < 10.0.27 | ≥ 10.1.0, < 10.1.45 | ≥ 11.0.0, < 11.0.11
Apache software foundation1 product
  • apache tomcat≥ 11.0.0-M1, ≤ 11.0.10 | ≥ 10.1.0-M1, ≤ 10.1.44 | ≥ 9.0.40, ≤ 9.0.108 | ≥ 8.5.60, ≤ 8.5.100
Org.apache.tomcat.embed1 product
  • tomcat-embed-core≥ 11.0.0-M1, < 11.0.11 | ≥ 10.1.0-M1, < 10.1.45 | ≥ 9.0.40, < 9.0.109 | ≥ 8.5.60, ≤ 8.5.100

7 vendors · 26 products

References

15 links
Show all 15 references