Critical Security Update for tomcat9: Bypass and Directory Traversal Vulnerabilities
Summary
ALSA-2025:23052: Important: tomcat9 security update. Affects tomcat9 versions < 1:9.0.87-8.el10_1.1. Fixed in 1:9.0.87-8.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tomcat9 is a widely used servlet container that serves as the reference implementation for Java Servlet and JavaServer Pages technologies. Developed under the Apache Software License version 2.0, Tomcat9 is designed for collaboration among top developers globally. It provides a robust platform for running Java applications, but vulnerabilities can expose applications to significant risks.
Vulnerability Detail
The vulnerabilities identified in tomcat9 include a bypass of rules in the Rewrite Valve (CVE-2025-31651) and a directory traversal issue that could lead to remote code execution (CVE-2025-55752). These vulnerabilities arise from improper handling of requests, allowing attackers to manipulate URL paths and potentially execute arbitrary code on the server, compromising the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
1:9.0.87-8.el10_1.1
This is the first release that contains the fix.
sudo dnf update tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the Rewrite Valve if it is not essential for your application. This can help mitigate the risk until the package is updated. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
The tomcat9 security update addresses critical vulnerabilities that could lead to serious security risks, including remote code execution. It is essential for users to update their packages to the latest version to protect their applications from potential attacks.
See every vulnerability recorded for tomcat9 →
FAQ
The main vulnerabilities are a bypass of rules in the Rewrite Valve and a directory traversal issue that could lead to remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider disabling the Rewrite Valve as a temporary workaround to reduce exposure.
These vulnerabilities can allow attackers to manipulate URL paths and potentially execute arbitrary code, leading to severe security breaches.
More information can be found on the CVE pages for CVE-2025-31651 and CVE-2025-55752, which detail the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
