Critical Security Update for Apache Tomcat: Bypass and Directory Traversal Vulnerabilities
Summary
ALSA-2025:23049: Important: tomcat security update. Affects tomcat versions < 1:9.0.87-6.el9_7.1. Fixed in 1:9.0.87-6.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used open-source servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java-based web applications, providing essential features such as request handling, session management, and security. However, recent vulnerabilities have been identified that could compromise the security of applications running on Tomcat, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities identified in Apache Tomcat include a bypass of rules in the Rewrite Valve (CVE-2025-31651) and a directory traversal issue that could lead to remote code execution (CVE-2025-55752). The Rewrite Valve is responsible for URL rewriting, and a bypass could allow unauthorized access to restricted resources. The directory traversal vulnerability could enable attackers to access sensitive files on the server, potentially leading to severe security breaches.
How To Fix
Minimum fixed version
1:9.0.87-6.el9_7.1
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive resources by implementing additional security rules in their web application configuration. However, this is not a substitute for applying the official patch.
Conclusion
The identified vulnerabilities in Apache Tomcat pose significant risks to applications running on this platform. Users must prioritize updating to the latest patched version to ensure the security of their systems. Utilizing tools like Vulert can help monitor for vulnerabilities and provide real-time alerts.
See every vulnerability recorded for tomcat →
FAQ
The main vulnerabilities are a bypass of rules in the Rewrite Valve and a directory traversal issue that could lead to remote code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without requiring access to the code. Visit Vulert Scanner to check if your application is affected.
It is highly recommended to update to the patched version 1:9.0.87-6.el9_7.1 or later to mitigate the vulnerabilities.
Yes, the vulnerabilities have been documented, and there is a risk of exploitation if the affected versions are not updated.
If an immediate update is not possible, consider implementing additional security measures to restrict access to sensitive resources as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
