CVE-2025-31651

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-31651
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-31651.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-31651
Aliases
Downstream
ALSA (4)
CGA (14)
CLEANSTART (4)
CLSA (17)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (17)
RLSA (4)
ROOT (1)
SUSE (6)
UBUNTU (1)
Related
ALSA (4)
openSUSE (2)
SUSE (6)
Published
2025-04-28T19:17:21Z
Modified
2026-10-24T10:34:21Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Tomcat: Bypass of rules in Rewrite Valve
Details

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-116"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31651.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "11.0.0-M1"
                        },
                        {
                            "last_affected": "11.0.5"
                        },
                        {
                            "introduced": "10.1.0-M1"
                        },
                        {
                            "last_affected": "10.1.39"
                        },
                        {
                            "introduced": "9.0.0.M1"
                        },
                        {
                            "last_affected": "9.0.102"
                        },
                        {
                            "introduced": "8.5.0"
                        },
                        {
                            "last_affected": "8.5.100"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
16bf392c67833ad549733b58c350ff92b5ee782a
Fixed
f8cfae0a0d1c8dc592099a1430cd08e352430823
Introduced
e9d17cddc285615807ec5fef09240777436b25dc
Fixed
1ee4bc9109d48cd062d1bc1a4c002358e03455e9
Introduced
56e547d387ab49f688c93fe9ca082b1b5d94deed
Fixed
872451298e20bb77ea95c499e6866b1e32b337e0
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.0.104"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0"
                },
                {
                    "fixed": "10.1.40"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "11.0.0"
                },
                {
                    "fixed": "11.0.6"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-31651.json"