Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2025-31651 BIT-tomcat-2025-31651EUVD-2025-13626GHSA-ff77-26x5-69cr

Apache Tomcat: Bypass of rules in Rewrite Valve

Published Apr 28, 2025 · Updated Feb 26, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-catalina Package: org.apache.tomcat.embed:tomcat-embed-core Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: tomcat10 Package: tomcat10 Package: tomcat11 Package: tomcat8 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible
for a specially crafted request to bypass some rewrite rules. If those
rewrite rules effectively enforced security constraints, those
constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.5, 10.1.0-M1 – ≤ 10.1.39, 9.0.0.M1 – ≤ 9.0.102, 8.5.0 – ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.40-1 —
Debian 14 tomcat11 11.0.6-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.40-1 —
Debian 13 tomcat11 11.0.6-1 —
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.40-1 —
Debian 12 tomcat9 9.0.70-2 —
Debian 11 tomcat9 9.0.107-0+deb11u1 DLA-4244-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS tomcat10 10.1.16-1ubuntu0.1~esm3 USN-7705-1
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS tomcat8 +1 No fix yet —
Ubuntu Pro 16.04 LTS tomcat8 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat +7 1:10.1.36-3.el10_1.1 RHSA-2025:23050
RHEL 10 tomcat9 +7 1:9.0.87-8.el10_1.1 RHSA-2025:23052
RHEL 9 tomcat +7 1:9.0.87-6.el9_7.1 RHSA-2025:23049
RHEL 8 tomcat +7 1:9.0.87-1.el8_10.7 RHSA-2025:23048
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS tomcat +7 1:10.1.36-1.el10_0.3 RHSA-2025:23051
RHEL 10.0 EUS tomcat9 +7 1:9.0.87-5.el10_0.4 RHSA-2025:23053
RHEL 9.6 EUS tomcat +7 1:9.0.87-3.el9_6.4 RHSA-2025:23044
RHEL 9.4 EUS tomcat +7 1:9.0.87-1.el9_4.7 RHSA-2025:23047
RHEL 9.2 E4S pki-servlet-engine +1 1:9.0.50-1.el9_2.3 RHSA-2026:0293
RHEL 9.2 E4S tomcat +7 1:9.0.87-1.el9_2.7 RHSA-2025:23046
RHEL 9.0 E4S pki-servlet-engine +1 1:9.0.43-4.el9_0.2 RHSA-2026:0292
RHEL 8.8 TUS tomcat +7 1:9.0.87-1.el8_8.8 RHSA-2025:23045
RHEL 8.8 E4S tomcat +7 1:9.0.87-1.el8_8.8 RHSA-2025:23045
RHEL 8.6 TUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2726
RHEL 8.6 TUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS fasterxml-oss-parent 69-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 TUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS jackson-bom +2 2.19.1-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 TUS jackson-databind +4 2.19.1-1.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 TUS jackson-parent 2.19.2-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 TUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS pki-servlet-engine +1 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 RHSA-2026:2726
RHEL 8.6 TUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS resteasy 3.0.26-6.module+el8.6.0+23400+aafc0b27 RHSA-2026:2726
RHEL 8.6 TUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 TUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 TUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2726
RHEL 8.6 E4S bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S fasterxml-oss-parent 69-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 E4S glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S jackson-bom +2 2.19.1-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 E4S jackson-databind +4 2.19.1-1.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 E4S jackson-parent 2.19.2-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 E4S jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S pki-servlet-engine +1 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 RHSA-2026:2726
RHEL 8.6 E4S python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S resteasy 3.0.26-6.module+el8.6.0+23400+aafc0b27 RHSA-2026:2726
RHEL 8.6 E4S slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 E4S velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 E4S xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2726
RHEL 8.6 AUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS fasterxml-oss-parent 69-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 AUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS jackson-bom +2 2.19.1-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 AUS jackson-databind +4 2.19.1-1.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 AUS jackson-parent 2.19.2-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 AUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS pki-servlet-engine +1 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 RHSA-2026:2726
RHEL 8.6 AUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS resteasy 3.0.26-6.module+el8.6.0+23400+aafc0b27 RHSA-2026:2726
RHEL 8.6 AUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 AUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 AUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.4 EUS Long Life apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2724
RHEL 8.4 EUS Long Life bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life fasterxml-oss-parent 69-3.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 EUS Long Life glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life jackson-bom +5 2.19.1-1.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 EUS Long Life jackson-core +1 2.19.1-2.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 EUS Long Life jackson-parent 2.19.2-1.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 EUS Long Life jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life pki-servlet-engine +1 1:9.0.30-1.module+el8.4.0+23942+fa6501e9.3 RHSA-2026:2724
RHEL 8.4 EUS Long Life python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life resteasy 3.0.26-6.module+el8.4.0+23399+fc91639f RHSA-2026:2724
RHEL 8.4 EUS Long Life slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2724
RHEL 8.4 EUS Long Life velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2724
RHEL 8.4 EUS Long Life xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2724
RHEL 8.4 AUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS fasterxml-oss-parent 69-3.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 AUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS jackson-bom +5 2.19.1-1.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 AUS jackson-core +1 2.19.1-2.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 AUS jackson-parent 2.19.2-1.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 AUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS pki-servlet-engine +1 1:9.0.30-1.module+el8.4.0+23942+fa6501e9.3 RHSA-2026:2724
RHEL 8.4 AUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS resteasy 3.0.26-6.module+el8.4.0+23399+fc91639f RHSA-2026:2724
RHEL 8.4 AUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2724
RHEL 8.4 AUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2724
RHEL 8.4 AUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.2 AUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS fasterxml-oss-parent 69-1.module+el8.2.0+23390+7631bd3f RHSA-2026:2725
RHEL 8.2 AUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS jackson-bom +7 2.19.1-1.module+el8.2.0+23390+7631bd3f RHSA-2026:2725
RHEL 8.2 AUS jackson-parent 2.19.2-1.module+el8.2.0+23390+7631bd3f RHSA-2026:2725
RHEL 8.2 AUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS pki-servlet-engine +1 1:9.0.7-16.module+el8.2.0+23940+b159abcc.3 RHSA-2026:2725
RHEL 8.2 AUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS resteasy 3.0.26-3.module+el8.2.0+23401+65186842 RHSA-2026:2725
RHEL 8.2 AUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2725
RHEL 8.2 AUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2725
RHEL 8.2 AUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
Red Hat JBoss Web Server 6 jws6-tomcat +9 10.1.36-19.redhat_00018.1.el8jws RHSA-2025:19809
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.87-14.redhat_00013.1.el7jws RHSA-2025:22925

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat +7 1:10.1.36-3.el10_1.1 ALSA-2025:23050
AlmaLinux 10 tomcat9 +7 1:9.0.87-8.el10_1.1 ALSA-2025:23052
AlmaLinux 9 tomcat +7 1:9.0.87-6.el9_7.1 ALSA-2025:23049
AlmaLinux 8 tomcat +7 1:9.0.87-1.el8_10.7 ALSA-2025:23048

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tomcat 1:10.1.36-3.el10_1.1 RLSA-2025:23050
Rocky Linux 10 tomcat9 1:9.0.87-8.el10_1.1 RLSA-2025:23052
Rocky Linux 9 tomcat 1:9.0.87-6.el9_7.1 RLSA-2025:23049
Rocky Linux 8 tomcat 1:9.0.87-1.el8_10.7 RLSA-2025:23048

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:01521-1
SLES 15 SP7 tomcat10 10.1.40-150200.5.40.1 SUSE-SU-2025:01537-1
SLES 15 SP6 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SLES 15 SP6 tomcat10 10.1.40-150200.5.40.1 SUSE-SU-2025:1537-1
SLES 15 SP5 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SLES 15 SP5 tomcat10 10.1.40-150200.5.40.1 SUSE-SU-2025:1537-1
SLES 15 SP4 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SLES 15 SP3 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 tomcat 9.0.36-3.142.1 SUSE-SU-2026:1058-1, SUSE-SU-2025:01882-1
SLES for SAP 15 SP5 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SLES for SAP 15 SP5 tomcat10 10.1.40-150200.5.40.1 SUSE-SU-2025:1537-1
SLES for SAP 15 SP4 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SLES for SAP 15 SP3 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SLE HPC 15 SP5 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SLE HPC 15 SP5 tomcat10 10.1.40-150200.5.40.1 SUSE-SU-2025:1537-1
SLE HPC 15 SP4 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SLE HPC 15 SP3 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SUSE Manager Server 4.3 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
SUSE Enterprise Storage 7.1 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.104-1.1 openSUSE-SU-2025:15048-1
openSUSE Tumbleweed tomcat10 10.1.40-1.1 openSUSE-SU-2025:15049-1
openSUSE Leap 15.6 tomcat 9.0.104-150200.81.1 SUSE-SU-2025:1521-1
openSUSE Leap 15.6 tomcat10 10.1.40-150200.5.40.1 SUSE-SU-2025:1537-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.40-1.amzn2023.0.1 ALAS2023-2025-965
Amazon Linux 2023 tomcat9 +7 1:9.0.104-1.amzn2023.0.1 ALAS2023-2025-964

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tomcat +7 1:10.1.36-3.el10_1.1 ELSA-2025-23050
Oracle Linux 10 tomcat9 +7 1:9.0.87-8.el10_1.1 ELSA-2025-23052
Oracle Linux 9 tomcat +7 1:9.0.87-6.el9_7.1 ELSA-2025-23049
Oracle Linux 8 tomcat +7 1:9.0.87-1.el8_10.7 ELSA-2025-23048

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling thingsboard +4 4.0.1-r1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-catalina >= 9.0.76, < 9.0.104 9.0.104 GHSA-ff77-26x5-69cr
Maven org.apache.tomcat:tomcat-catalina >= 10.1.10, < 10.1.40 10.1.40 GHSA-ff77-26x5-69cr
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M2, < 11.0.6 11.0.6 GHSA-ff77-26x5-69cr
Maven org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100 — GHSA-ff77-26x5-69cr
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.76, < 9.0.104 9.0.104 GHSA-ff77-26x5-69cr
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.10, < 10.1.40 10.1.40 GHSA-ff77-26x5-69cr
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M2, < 11.0.6 11.0.6 GHSA-ff77-26x5-69cr
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 — GHSA-ff77-26x5-69cr

Advisories 50

References