Apache Tomcat Rewrite Rule Bypass Vulnerability - CVE-2025-31651
Summary
CVE-2025-31651: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite r... Affects tomcat10 versions >= 16bf392c67833ad549733b58c350ff92b5ee782a, < f8cfae0a0d1c8dc592099a1430cd08e352430823. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely used open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It provides a robust environment for running Java applications and is known for its scalability and performance. However, certain configurations of rewrite rules in Tomcat can lead to security vulnerabilities, such as the one identified in CVE-2025-31651, which allows for potential bypass of security constraints.
Vulnerability Detail
CVE-2025-31651 is an improper neutralization of escape, meta, or control sequences vulnerability in Apache Tomcat. This vulnerability arises from specific rewrite rule configurations that can be exploited by specially crafted requests. If these rewrite rules are intended to enforce security constraints, attackers may bypass these constraints, leading to unauthorized access or actions within the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can review and modify their rewrite rule configurations to ensure that they do not inadvertently allow bypassing of security constraints. It is advisable to avoid using complex or unlikely rewrite rule configurations until the upgrade can be performed.
Conclusion
CVE-2025-31651 presents a significant risk for users of Apache Tomcat due to its potential to bypass security constraints through specific rewrite rule configurations. It is crucial for users to upgrade to the patched versions of Tomcat to mitigate this vulnerability and ensure the security of their applications.
See every vulnerability recorded for tomcat10 →
FAQ
CVE-2025-31651 is a vulnerability in Apache Tomcat that allows attackers to bypass security constraints through improper handling of rewrite rules.
The affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.5, 10.1.0-M1 through 10.1.39, and 9.0.0.M1 through 9.0.102.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate upgrading is not possible, review and adjust your rewrite rule configurations to minimize the risk of bypassing security constraints.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. More information can be found at https://vulert.com.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
