Back to overview

CVE-2025-31651

CRITICAL
9.8
CVSS 3.1
Description
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Metadata

CVE ID
CVE-2025-31651
State
PUBLISHED
Assigner
apache
Reserved
2025-03-31 12:25 UTC
Published
2025-04-28 19:17 UTC
Last updated
2026-02-26 18:27 UTC
Primary CWE
CWE-116
CWE-116 Improper Encoding or Escaping of Output
Vendor / Product
Apache Software Foundation / Apache Tomcat
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Apache Software Foundation Apache Tomcat — 11.0.0-M1 ≤ 11.0.5, 10.1.0-M1 ≤ 10.1.39, 9.0.0.M1 ≤ 9.0.102, 8.5.0 ≤ 8.5.100 …
Weakness (CWE)
CWESourceDescription
CWE-116 cna CWE-116 Improper Encoding or Escaping of Output
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (1)
Back to overview