Bug 2362782 (CVE-2025-31651) - CVE-2025-31651 tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve [NEEDINFO]
Summary: CVE-2025-31651 tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve
Keywords:
Status: NEW
Alias: CVE-2025-31651
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2363040 2363041 2363042
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-28 20:01 UTC by OSIDB Bzimport
Modified: 2025-09-22 20:24 UTC (History)
13 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:
aogburn: needinfo? (prodsec-dev)

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-28 20:01:19 UTC 
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible 
for a specially crafted request to bypass some rewrite rules. If those 
rewrite rules effectively enforced security constraints, those 
constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Comment 8 Greg K 2025-05-15 02:20:13 UTC 
see apache httpd CVE-2024-38474, this issue is not identical
Note You need to log in before you can comment on or make changes to this bug.