Critical Security Update for Apache Tomcat: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:23050: Important: tomcat security update. Affects tomcat versions < 1:10.1.36-3.el10_1.1. Fixed in 1:10.1.36-3.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used open-source servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications, providing essential features such as request handling, session management, and security configurations. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of applications running on Tomcat.
Vulnerability Detail
The vulnerabilities in Apache Tomcat include a bypass of rules in the Rewrite Valve (CVE-2025-31651), a denial of service issue (CVE-2025-61795), and a directory traversal vulnerability that could lead to remote code execution (CVE-2025-55752). These vulnerabilities arise from flaws in the handling of requests and responses, which could allow attackers to manipulate application behavior, disrupt service availability, or execute arbitrary code on the server.
How To Fix
Minimum fixed version
1:10.1.36-3.el10_1.1
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected components by configuring your firewall to limit incoming requests or by disabling the Rewrite Valve if it is not essential for your application. However, these are not permanent solutions and should only be used until the update can be applied.
Conclusion
In summary, the recent vulnerabilities in Apache Tomcat pose significant risks to applications relying on this servlet container. It is crucial to apply the security updates promptly to mitigate these risks and ensure the integrity and availability of your applications.
See every vulnerability recorded for tomcat →
FAQ
Apache Tomcat is an open-source implementation of the Java Servlet and JavaServer Pages (JSP) specifications, allowing developers to run Java applications.
The update addresses three vulnerabilities: a bypass of rules in the Rewrite Valve, a denial of service issue, and a directory traversal vulnerability that could lead to remote code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application in the Vulert playground without any signup.
If an immediate update is not possible, consider implementing temporary workarounds such as restricting access to affected components or disabling non-essential features.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
