CVE-2025-46701

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

A vulnerability was found in Apache Tomcat up to 9.0.104/10.1.40/11.0.6 (Application Server Software) and classified as critical.Using CWE to declare the problem leads to CWE-178. The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.Impacted is integrity.Upgrading to version 9.0.105, 10.1.41 or 11.0.7 eliminates this vulnerability.(CVE-2025-46701)

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)

• org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve (CVE-2025-55668)

• org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
• tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
• tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
• tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
• tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
• tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
• tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
• tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.6, from 10.1.0 through 10.1.40, from 9.0.0 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

TuxCare rebuilt 3 packages to address 10 CVEs. Fixed in 8.5.100.tuxcare.1.

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.

TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.

TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.

TuxCare rebuilt 4 packages to address 12 CVEs. Fixed in 9.0.100-tuxcare.1.

TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.

TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 9.0.90-tuxcare.2.

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.50-tuxcare.6.

TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 9.0.46-tuxcare.3.

• CVE-2024-52316: fix JASPIC authentication bypass on ServerAuthContext exception
• CVE-2025-55754: fix ANSI escape sequence injection in log messages
• CVE-2025-46701: fix CGI servlet case sensitivity bypass of security constraints

• CVE-2024-52316: fix unchecked error condition in Jakarta Authentication (JASPIC) ServerAuthContext
• CVE-2025-46701: fix case sensitivity bypass in CGI servlet pathInfo
• CVE-2025-55754: add escaping to logging output for ANSI sequences

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

TuxCare rebuilt 6 packages to address 17 CVEs. Fixed in 10.1.33-tuxcare.1.

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

TuxCare rebuilt 4 packages to address 6 CVEs. Fixed in 7.0.70-tuxcare.6.

Security constraint bypass for CGI scripts. (CVE-2025-46701)

These are all security issues fixed in the tomcat-9.0.106-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat10-10.1.42-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat11-11.0.8-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2025-46701 in the io.root.org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available.

This update for tomcat fixes the following issues:

• CVE-2025-46701: Refactored CGI servlet to access resources via WebResources (bsc#1243815).
• CVE-2025-48988: Limited the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).
• CVE-2025-49125: Expand checks for webAppMount (bsc#1244649).

This update for tomcat10 fixes the following issues:

• Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).
• Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).
• Fixed expand checks for webAppMount (bsc#1244649).
• Hardening permissions (bsc#1242722)

Update to Tomcat 10.1.42:

• Fixed CVEs:

  • CVE-2025-46701: refactor CGI servlet to access resources via WebResources (bsc#1243815)
  • CVE-2025-48988: limits the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656)
  • CVE-2025-49125: Expand checks for webAppMount (bsc#1244649)

• Catalina:

  • Add: Support for the java:module namespace which mirrors the java:comp namespace.
  • Add: Support parsing of multiple path parameters separated by ; in a single URL segment. Based on pull request #860 by Chenjp.
  • Add: Support for limiting the number of parameters in HTTP requests through the new ParameterLimitValve. The valve allows configurable URL-specific limits on the number of parameters.
  • Fix: 69699: Encode redirect URL used by the rewrite valve with the session id if appropriate, and handle cross context with different session configuration when using rewrite.
  • Add: #863: Support for comments at the end of lines in text rewrite map files to align behaviour with Apache httpd. Pull request provided by Chenjp.
  • Fix: 69706: Saved request serialization issue in FORM introduced when allowing infinite session timeouts.
  • Fix: Expand the path checks for Pre-Resources and Post-Resources mounted at a path within the web application.
  • Fix: Use of SSS in SimpleDateFormat pattern for AccessLogValve.
  • Fix: Process possible path parameters rewrite production in the rewrite valve.
  • Fix: 69588: Enable allowLinking to be set on PreResources, JarResources and PostResources. If not set explicitly, the setting will be inherited from the Resources.
  • Add: 69633: Support for Filters using context root mappings.
  • Fix: 69643: Optimize directory listing for large amount of files. Patch submitted by Loic de l'Eprevier.
  • Fix: #843: Off by one validation logic for partial PUT ranges and associated test case. Submitted by Chenjp.
  • Refactor: Replace the unused buffer in org.apache.catalina.connector.InputBuffer with a static, zero length buffer.
  • Refactor: GCI servlet to access resources via the WebResource API.
  • Fix: 69662: Report name in exception message when a naming lookup failure occurs. Based on code submitted by Donald Smith.
  • Fix: Ensure that the FORM authentication attribute authenticationSessionTimeout works correctly when sessions have an infinite timeout when authentication starts.
  • Add: Provide a content type based on file extension when web application resources are accessed via a URL.

• Coyote

  • Refactor: #861: TaskQueue to use the new interface RetryableQueue which enables better integration of custom Executors which provide their own BlockingQueue implementation. Pull request provided by Paulo Almeida.
  • Add: Finer grained control of multi-part request processing via two new attributes on the Connector element. maxPartCount limits the total number of parts in a multi-part request and maxPartHeaderSize limits the size of the headers provided with each part. Add support for these new attributes to the ParameterLimitValve.
  • Refactor: The SavedRequestInputFilter so the buffered data is used directly rather than copied.

• Jasper:

  • Fix: 69696: Mark the JSP wrapper for reload after a failed compilation.
  • Fix: 69635: Add support to jakarta.el.ImportHandler for resolving inner classes.
  • Add:…

This update for tomcat fixes the following issues:

• CVE-2025-46701: Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).
• CVE-2025-48988: Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).
• CVE-2025-49125: Fixed expand checks for webAppMount (bsc#1244649).

Other bugfixes:

• Made permissions more secure (bsc#1242722)

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.115:

• CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
• CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
• CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
• CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
• CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
• CVE-2023-44487: Rapid reset attack (bsc#1216182).

It was discovered that Tomcat did not correctly handle case sensitivity. An attacker could possibly use this issue to bypass authentication mechanisms. (CVE-2025-46701)

Elysee Franchuk discovered that Tomcat did not correctly limit the number of attributes for a session. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-54677)

It was discovered that Tomcat did not correctly sanitize certain URLs. An attacker could possibly use this issue to bypass authentication mechanisms. (CVE-2025-31651)

It was discovered that Tomcat did not correctly handle certain malformed HTTP headers, which could lead to a memory leak. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2025-31650)

It was discovered that Tomcat did not correctly handle concurrent operations under certain circumstances. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-50379)

It was discovered that Tomcat did not correctly handle certain authentication errors. An attacker could possibly use this issue to bypass authentication mechanisms. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-52316)