Vulnerability

CERT-In Vulnerability Note CIVN-2025-0089
Multiple Vulnerabilities in Apache Tomcat

Original Issue Date:May 01, 2025

Severity Rating: HIGH

Software Affected

Apache Tomcat version 11.0.0-M1 to 11.0.5
Apache Tomcat version 11.0.0-M2 to 11.0.5
Apache Tomcat version 10.1.0-M1 to 10.1.39
Apache Tomcat version 10.1.10 to 10.1.39
Apache Tomcat version 9.0.0.M1 to 9.0.102
Apache Tomcat version 9.0.76 to 9.0.102

Overview

Multiple vulnerabilities have been reported in Apache Tomcat, which could allow an attacker to cause memory corruption, denial of service or gain access to sensitive information on a targeted system.

Target Audience:
All end-user organisations and individuals responsible for maintaining and updating Apache Tomcat.

Risk Assessment:
Very High risk of unauthorized access to sensitive data.

Impact Assessment:
Potential for denial of service.

Description

Apache Tomcat is an open-source web server and servlet container that runs Java-based web applications.

Multiple vulnerabilities have been identified in Apache Tomcat due to improper input validation and improper handling of escape, meta, or control sequences. Under certain uncommon rewrite rule configurations, a specially crafted request could bypass specific rewrite rules. If these rules were used to enforce security constraints, an attacker might be able to bypass those protections.

Successful exploitation of these vulnerabilities could allow an attacker to cause memory corruption, denial of service or gain access to sensitive information on a targeted system.

Solution

Apply appropriate fixes as mentioned in the Apache Tomcat Security Advisory:
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.104

https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.40

https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.6

Vendor Information

Apache Tomcat
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.104
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.40
https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.6

CVE Name
CVE-2025-31651
CVE-2025-31650

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India