CVE-2025-31651

Published Apr 28, 2025

Last updated 4 months ago

CVSS critical 9.8

Overview

Description: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Source: security@apache.org
NVD status: Modified
Products: tomcat

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@apache.org: CWE-116
nvd@nist.gov: CWE-116

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BB09D245-9455-444D-8265-743642DD53C9",
            "versionEndExcluding": "9.0.104",
            "versionStartIncluding": "9.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E5BD6C26-75CE-4DDC-BF4D-5A5187BD4CAF",
            "versionEndExcluding": "10.1.40",
            "versionStartIncluding": "10.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9331B3B3-C3C4-4D12-BE11-043F6614B2D3",
            "versionEndExcluding": "11.0.6",
            "versionStartIncluding": "11.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References