CVE-2025-31651
2 advisories.
Maven/org.apache.tomcat:tomcat-catalina CVE-2025-31651: critical 9.8
Apache Tomcat Rewrite rule bypass
Action: Upgrade org.apache.tomcat:tomcat-catalina to 9.0.104 (9.x), 10.1.40 (10.x) or 11.0.6 (11.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.76 | 9.0.104 | - |
| 10.1.10 | 10.1.40 | - |
| 11.0.0-M2 | 11.0.6 | - |
| 8.5.0 | - | 8.5.100 |
Fixed versions
| 9.0.104 | 10.1.40 | 11.0.6 |
Sources
- osv: GHSA-ff77-26x5-69cr
- nvd: CVE-2025-31651
- https://github.com/apache/tomcat/commit/066bf6b6a15a4e7e0941d4acf096841165b97098
- https://github.com/apache/tomcat/commit/175dc75fc428930034a6c93fb52f830d955d8e64
- https://github.com/apache/tomcat/commit/ee3ab548e92345eca0cbd1f01649eb36c6f29454
- https://github.com/apache/tomcat/commit/fbecc915a10c5a3d634c5e2c6ced4ff479ce9953
- https://github.com/apache/tomcat
- https://lists.apache.org/list.html?announce@tomcat.apache.org
- https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- http://www.openwall.com/lists/oss-security/2025/04/28/3
CVE-2025-31651 · published · modified · JSON
Maven/org.apache.tomcat.embed:tomcat-embed-core CVE-2025-31651: critical 9.8
Apache Tomcat Rewrite rule bypass
Action: Upgrade org.apache.tomcat.embed:tomcat-embed-core to 9.0.104 (9.x), 10.1.40 (10.x) or 11.0.6 (11.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.76 | 9.0.104 | - |
| 10.1.10 | 10.1.40 | - |
| 11.0.0-M2 | 11.0.6 | - |
| 8.5.0 | - | 8.5.100 |
Fixed versions
| 9.0.104 | 10.1.40 | 11.0.6 |
Sources
- osv: GHSA-ff77-26x5-69cr#Maven/org.apache.tomcat.embed:tomcat-embed-core
- nvd: CVE-2025-31651
- https://github.com/apache/tomcat/commit/066bf6b6a15a4e7e0941d4acf096841165b97098
- https://github.com/apache/tomcat/commit/175dc75fc428930034a6c93fb52f830d955d8e64
- https://github.com/apache/tomcat/commit/ee3ab548e92345eca0cbd1f01649eb36c6f29454
- https://github.com/apache/tomcat/commit/fbecc915a10c5a3d634c5e2c6ced4ff479ce9953
- https://github.com/apache/tomcat
- https://lists.apache.org/list.html?announce@tomcat.apache.org
- https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- http://www.openwall.com/lists/oss-security/2025/04/28/3
CVE-2025-31651 · published · modified · JSON