Summary
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Security Fix(es):
* tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | tomcat9 | 1:9.0.87-8.el10_1.1 |
| AlmaLinux · 10 | tomcat9-admin-webapps | 1:9.0.87-8.el10_1.1 |
| AlmaLinux · 10 | tomcat9-docs-webapp | 1:9.0.87-8.el10_1.1 |
| AlmaLinux · 10 | tomcat9-el-3.0-api | 1:9.0.87-8.el10_1.1 |
| AlmaLinux · 10 | tomcat9-jsp-2.3-api | 1:9.0.87-8.el10_1.1 |
| AlmaLinux · 10 | tomcat9-lib | 1:9.0.87-8.el10_1.1 |
| AlmaLinux · 10 | tomcat9-servlet-4.0-api | 1:9.0.87-8.el10_1.1 |
| AlmaLinux · 10 | tomcat9-webapps | 1:9.0.87-8.el10_1.1 |
Vulnerabilities 2
-
Critical 9.8CVE-2025-31651 Public exploit
Apache Tomcat: Bypass of rules in Rewrite Valve
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectivel…
-
High 7.5
Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the UR…