DEBIAN-CVE-2025-46701

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

References

https://security-tracker.debian.org/tracker/CVE-2025-46701

Affected packages

Debian:12

tomcat10

Package

Name: tomcat10
Purl: pkg:deb/debian/tomcat10?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.1.52-1~deb12u1

Affected versions

10.*

10.1.6-1

10.1.6-1+deb12u1

10.1.6-1+deb12u2

10.1.7-1

10.1.8-1

10.1.9-1

10.1.10-1

10.1.13-1

10.1.14-1

10.1.15-1

10.1.16-1

10.1.20-1

10.1.23-1

10.1.25-1~bpo12+1

10.1.25-1

10.1.25-2

10.1.30-1~bpo12+1

10.1.30-1

10.1.31-1

10.1.33-1~bpo12+1

10.1.33-1

10.1.34-0+deb12u1

10.1.34-0+deb12u2

10.1.34-1

10.1.35-1

10.1.40-1~bpo12+1

10.1.40-1

10.1.46-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-46701.json"

tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.0.70-2

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-46701.json"

Debian:13

tomcat10

Package

Name: tomcat10
Purl: pkg:deb/debian/tomcat10?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.1.52-1~deb13u1

Affected versions

10.*

10.1.40-1

10.1.46-1

10.1.52-1~deb12u1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-46701.json"

tomcat11

Package

Name: tomcat11
Purl: pkg:deb/debian/tomcat11?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

11.0.15-1~deb13u1

Affected versions

11.*

11.0.6-1

11.0.11-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-46701.json"

tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.0.70-2

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-46701.json"

Debian:14

tomcat10

Package

Name: tomcat10
Purl: pkg:deb/debian/tomcat10?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.1.46-1

Affected versions

10.*

10.1.40-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-46701.json"

tomcat11

Package

Name: tomcat11
Purl: pkg:deb/debian/tomcat11?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

11.0.11-1

Affected versions

11.*

11.0.6-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-46701.json"

tomcat9

Package

Name: tomcat9
Purl: pkg:deb/debian/tomcat9?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.0.70-2

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-46701.json"