CVE-2025-31651: Apache Tomcat: Bypass of rules in Rewrite Valve

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-28 · updated 2026-06-17
Weakness: CWE-116

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Summary

Apache Tomcat's Rewrite Valve can be bypassed by a specially crafted request under a subset of unlikely rewrite rule configurations, allowing security constraints enforced through those rules to be circumvented. The flaw affects Tomcat 11.0.0-M1 through 11.0.5, 10.1.0-M1 through 10.1.39, and 9.0.0.M1 through 9.0.102, plus EOL versions 8.5.0 through 8.5.100. It is rated CVSS 9.8 critical, but there is no evidence of exploitation (not in CISA KEV, SSVC exploitation: none, EPSS 4.2%). Upgrade to 11.0.6, 10.1.40, or 9.0.104 to fix the issue.

يمكن تجاوز Rewrite Valve في Apache Tomcat عبر طلب مُصمَّم خصيصًا في مجموعة محدودة من إعدادات قواعد إعادة الكتابة غير المرجّحة، مما يسمح بتجاوز قيود الأمان التي تفرضها تلك القواعد. تؤثر الثغرة في Tomcat 11.0.0-M1 حتى 11.0.5، و10.1.0-M1 حتى 10.1.39، و9.0.0.M1 حتى 9.0.102، إضافة إلى الإصدارات المنتهية الدعم 8.5.0 حتى 8.5.100. صُنّفت الثغرة بدرجة 9.8 حرجة وفق CVSS، لكن لا يوجد دليل على استغلالها فعليًا (ليست في CISA KEV، وSSVC exploitation: none، واحتمال EPSS للاستغلال خلال 30 يومًا 4.2%). يُنصح بالترقية إلى 11.0.6 أو 10.1.40 أو 9.0.104 لإصلاح المشكلة.

Affected products

Apache Tomcat: from 9.0.0 before 9.0.104; from 10.1.0 before 10.1.40; from 11.0.0 before 11.0.6 — fixed in 10.1.40, 11.0.6, 9.0.104

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.40, 11.0.6, 9.0.104. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-31651 or the next vulnerability affects your stack