CVE-2025-46701: Apache Tomcat: Security constraint bypass for CGI scripts

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-29 · updated 2026-06-17
Weakness: CWE-178

Description

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

Affected products

Apache Tomcat: from 9.0.0 before 9.0.105; from 10.1.0 before 10.1.41; from 11.0.0 before 11.0.7 — fixed in 10.1.41, 11.0.7, 9.0.105

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.41, 11.0.7, 9.0.105. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-46701 or the next vulnerability affects your stack