Case Sensitivity Bypass Vulnerability in Apache Tomcat (CVE-2025-46701)
Summary
CVE-2025-46701: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. Affects tomcat10 versions >= 16bf392c67833ad549733b58c350ff92b5ee782a, < 15c524d11651708bc046929139e6b633f2a50fb5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The GCI servlet in Tomcat is responsible for handling Common Gateway Interface (CGI) requests. This vulnerability arises from improper handling of case sensitivity in the pathInfo component of a URI mapped to the GCI servlet, potentially allowing unauthorized access to restricted resources.
Vulnerability Detail
The vulnerability identified as CVE-2025-46701 is due to improper handling of case sensitivity in Apache Tomcat's GCI servlet. This flaw allows attackers to bypass security constraints that are supposed to protect certain paths, leading to unauthorized access to sensitive information or functionality. The issue affects multiple versions of Tomcat, specifically from 11.0.0-M1 through 11.0.6, 10.1.0-M1 through 10.1.40, and 9.0.0.M1 through 9.0.104. Attackers could exploit this vulnerability by crafting specific requests that manipulate the case of URI components, thereby circumventing security measures.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement additional security measures such as configuring access controls at the application level to restrict access to sensitive resources, or by using a reverse proxy that can enforce stricter URI handling.
Conclusion
CVE-2025-46701 is a significant vulnerability affecting multiple versions of Apache Tomcat, allowing for potential security constraint bypasses. Users are strongly encouraged to upgrade to the latest patched versions to mitigate risks. Implementing temporary workarounds can provide additional security until an upgrade can be performed.
See every vulnerability recorded for tomcat10 →
FAQ
CVE-2025-46701 is a vulnerability in Apache Tomcat that allows attackers to bypass security constraints due to improper handling of case sensitivity in URI paths.
The affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.6, 10.1.0-M1 through 10.1.40, and 9.0.0.M1 through 9.0.104.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, consider implementing additional security measures to restrict access to sensitive resources as a temporary workaround.
More information can be found in the official Apache Tomcat release notes and security advisories related to CVE-2025-46701.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
