CVE-2025-55668: Apache Tomcat Session Fixation Vulnerability in tomcat-catalina
Summary
CVE-2025-55668: Apache Tomcat Session Fixation vulnerability. Affects org.apache.tomcat:tomcat-catalina across 3 version ranges.
>= 9.0.0.M1, < 9.0.106
>= 10.1.0-M1, < 10.1.42
>= 11.0.0-M1, < 11.0.8
Fixed in 9.0.106, 10.1.42 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-55668 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely used open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It provides a robust platform for running Java applications and is known for its scalability, performance, and ease of use. However, certain versions of Tomcat have been found to be vulnerable to a session fixation issue, which could allow attackers to hijack user sessions.
Vulnerability Detail
The vulnerability arises from a session fixation flaw in the rewrite valve of Apache Tomcat. This issue affects versions from 11.0.0-M1 to 11.0.7, 10.1.0-M1 to 10.1.41, and 9.0.0.M1 to 9.0.105. An attacker could exploit this vulnerability to gain unauthorized access to user sessions, potentially leading to data breaches or unauthorized actions within the application. The vulnerability is classified under CWE-384, indicating a weakness related to session management.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0.0.M1, < 9.0.1069.0.106 -
>= 10.1.0-M1, < 10.1.4210.1.42 -
>= 11.0.0-M1, < 11.0.811.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional session management controls, such as regenerating session IDs upon user authentication or using secure cookies to mitigate the risk of session fixation until the upgrade can be performed.
Conclusion
The CVE-2025-55668 vulnerability in Apache Tomcat poses a significant risk due to session fixation issues. Users are strongly advised to upgrade to the latest patched versions to secure their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for org.apache.tomcat:tomcat-catalina →
FAQ
CVE-2025-55668 is a vulnerability in Apache Tomcat that allows session fixation attacks, potentially compromising user sessions.
Affected versions include Apache Tomcat 11.0.0-M1 to 11.0.7, 10.1.0-M1 to 10.1.41, and 9.0.0.M1 to 9.0.105.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application's pom.xml for vulnerabilities without needing to sign up.
The CVSS score for CVE-2025-55668 is 6.5, indicating a moderate severity level.
If immediate upgrading is not possible, implement session management best practices as a temporary workaround to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-catalina.
