Critical Security Update for Apache Tomcat: Bypass and Directory Traversal Vulnerabilities
Summary
ALSA-2025:23048: Important: tomcat security update. Affects tomcat versions < 1:9.0.87-1.el8_10.7. Fixed in 1:9.0.87-1.el8_10.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications and is known for its robustness and scalability. However, recent vulnerabilities have been identified that could potentially compromise the security of applications running on Tomcat, specifically through the Rewrite Valve and directory traversal mechanisms.
Vulnerability Detail
The vulnerabilities identified in Apache Tomcat include a bypass of rules in the Rewrite Valve (CVE-2025-31651) and a directory traversal issue that could lead to remote code execution (CVE-2025-55752). These vulnerabilities arise from improper handling of requests, allowing attackers to manipulate URL paths and gain unauthorized access to sensitive files or execute arbitrary code on the server. The implications of these vulnerabilities are severe, as they could lead to data breaches, unauthorized access, and complete system compromise.
How To Fix
Minimum fixed version
1:9.0.87-1.el8_10.7
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected components by configuring your firewall to block unauthorized requests or by disabling the Rewrite Valve until the update can be applied. However, this is not a permanent solution and should only be used until the patch is implemented.
Conclusion
In summary, Apache Tomcat has critical vulnerabilities that need immediate attention. Updating to the patched version is crucial to ensure the security of applications running on this platform. Users should also consider using tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for tomcat →
FAQ
The vulnerabilities include a bypass of rules in the Rewrite Valve and a directory traversal issue that could lead to remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
The impact can be severe, potentially leading to unauthorized access, data breaches, and remote code execution on the server.
It is recommended to regularly check for updates and apply security patches as soon as they are released to mitigate vulnerabilities.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
