CVE-2025-31651: Apache Tomcat: Bypass of rules in Rewrite Valve
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.
Users are recommended to upgrade to version [FIXEDVERSION], which fixes the issue.
Other sources
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version [FIXEDVERSION], which fixes the issue.
— MITRE
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.
Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6, which fix the issue.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 11.0.6 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 10.1.40 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 9.0.104 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 11.0.6 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 10.1.40 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 9.0.104 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.104 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.40 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.6 - Compensating control
If immediate upgrade is not possible, review whether your rewrite rules enforce security constraints, and temporarily disable or reduce exposure of the affected rewrite-rule configurations until you can upgrade to 9.0.104, 10.1.40, or 11.0.6.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31651?
CVE-2025-31651 has been rated as a medium-severity vulnerability due to the specific conditions under which it can be exploited.
How do I fix CVE-2025-31651?
To fix CVE-2025-31651, upgrade to Apache Tomcat versions 11.0.6, 10.1.40, or 9.0.103 or later.
Who is affected by CVE-2025-31651?
CVE-2025-31651 affects Apache Tomcat versions 11.0.0-M1 to 11.0.5, 10.1.0-M1 to 10.1.39, and 9.0.0-M1 to 9.0.102.
What type of vulnerability is CVE-2025-31651?
CVE-2025-31651 is classified as an Improper Neutralization of Escape, Meta, or Control Sequences vulnerability.
What can happen if CVE-2025-31651 is exploited?
If exploited, CVE-2025-31651 can allow a specially crafted request to bypass certain security measures enforced by rewrite rules.