Every CVE Search/ Get API key

CVE-2025-31651

Apache Tomcat: Bypass of rules in Rewrite Valve

9.8 CriticalPublic exploitFix available

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.26%Up 4.2 points since Apr 29, 2025
90%50%10%1%

What each source reports

NVD Score used 9.8

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Record
CVE-2025-31651
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-116
Updated
2026-11-02
CVE List 9.8

Apache Tomcat: Bypass of rules in Rewrite Valve

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Record
CVE-2025-31651
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-116
Updated
2026-11-02
EUVDEUVD-2025-13626 9.8

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Record
EUVD-2025-13626
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-ff77-26x5-69cr 2.7

Apache Tomcat Rewrite rule bypass

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6, which fix the issue.

Record
GHSA-ff77-26x5-69cr
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-116, CWE-150
Updated
2026-11-02
OSV 9.8

Apache Tomcat: Bypass of rules in Rewrite Valve

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Record
CVE-2025-31651
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-116
Updated
2026-11-02
OSVDEBIAN-CVE-2025-31651 9.8

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Record
DEBIAN-CVE-2025-31651
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 48 moreShow less
OSVGHSA-ff77-26x5-69cr 2.7

Apache Tomcat Rewrite rule bypass

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6, which fix the issue.

Record
GHSA-ff77-26x5-69cr
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-116, CWE-150
Updated
2026-11-02
OSVOESA-2025-1484 9.8

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.

Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.(CVE-2025-31650)

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2025-31651)

Record
OESA-2025-1484
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:19809 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.3 release and security update

Record
RHSA-2025:19809
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22925 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.6 release and security update

Record
RHSA-2025:22925
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23044 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:23044
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23045 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:23045
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23046 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:23046
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23047 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:23047
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23048 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:23048
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23049 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:23049
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23050 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:23050
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23051 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:23051
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23052 7.5

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2025:23052
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:23053 7.5

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2025:23053
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0292 7.5

Red Hat Security Advisory: pki-servlet-engine security update

Record
RHSA-2026:0292
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0293 7.5

Red Hat Security Advisory: pki-servlet-engine security update

Record
RHSA-2026:0293
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:2724 7.5

Red Hat Security Advisory: pki-deps:10.6 security update

Record
RHSA-2026:2724
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:2725 7.5

Red Hat Security Advisory: pki-deps:10.6 security update

Record
RHSA-2026:2725
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:2726 7.5

Red Hat Security Advisory: pki-deps:10.6 security update

Record
RHSA-2026:2726
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:23048 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:23048
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:23049 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:23049
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:23050 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service (CVE-2025-61795)

  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:23050
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:23052 7.5

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:23052
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-31651 9.8

CVE-2025-31651 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2025-31651 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2025-31651
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-31651 9.8

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Record
UBUNTU-CVE-2025-31651
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2025:23048 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:23048
Updated
2026-11-02
OSVALSA-2025:23049 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:23049
Updated
2026-11-02
OSVALSA-2025:23050 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service (CVE-2025-61795)
  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:23050
Updated
2026-11-02
OSVALSA-2025:23052 No score

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:23052
Updated
2026-11-02
OSVBIT-tomcat-2025-31651 No score

Apache Tomcat: Bypass of rules in Rewrite Valve

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.5, from 10.1.0 through 10.1.39, from 9.0.0 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Record
BIT-tomcat-2025-31651
Updated
2026-11-02
OSVCLSA-2025-1750780819 No score

Fix CVE(s): CVE-2025-31651

  • SECURITY UPDATE: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability
    • debian/patches/CVE-2025-31651.patch: Enforces rewrite rules to preventing bypass of security constraints in specific configurations
    • CVE-2025-31651
Record
CLSA-2025-1750780819
Updated
2026-11-02
OSVCLSA-2025-1750785145 No score

tomcat: Fix of CVE-2025-31651

  • CVE-2025-31651: enforces rewrite rules to preventing bypass of security constraints in specific configurations
Record
CLSA-2025-1750785145
Updated
2026-11-02
OSVCLSA-2025-1751500955 No score

TuxCare security update for 3 packages (10 CVEs)

TuxCare rebuilt 3 packages to address 10 CVEs. Fixed in 8.5.100.tuxcare.1.

Record
CLSA-2025-1751500955
Updated
2026-11-02
OSVCLSA-2025-1752087582 No score

Fix CVE(s): CVE-2025-31651

  • SECURITY UPDATE: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability
    • debian/patches/CVE-2025-31651.patch: Enforces rewrite rules to preventing bypass of security constraints in specific configurations
    • CVE-2025-31651
Record
CLSA-2025-1752087582
Updated
2026-11-02
OSVCLSA-2025-1756253007 No score

TuxCare security update for 5 packages (18 CVEs)

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.

Record
CLSA-2025-1756253007
Updated
2026-11-02
OSVCLSA-2025-1761576180 No score

Fix CVE(s): CVE-2025-31651

  • SECURITY UPDATE: Bypassing of some rewrite rules by a specially crafted request
    • debian/patches/CVE-2025-31651.patch: better handling of URLs
    • CVE-2025-31651
Record
CLSA-2025-1761576180
Updated
2026-11-02
OSVCLSA-2025-1764716872 No score

tomcat: Fix of CVE-2025-31651

  • CVE-2025-31651: fix improper neutralization of escape, meta, or control sequences
Record
CLSA-2025-1764716872
Updated
2026-11-02
OSVCLSA-2025-1765411683 No score

TuxCare security update for 4 packages (15 CVEs)

TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.

Record
CLSA-2025-1765411683
Updated
2026-11-02
OSVCLSA-2025-1766362095 No score

TuxCare security update for 4 packages (12 CVEs)

TuxCare rebuilt 4 packages to address 12 CVEs. Fixed in 9.0.100-tuxcare.1.

Record
CLSA-2025-1766362095
Updated
2026-11-02
OSVCLSA-2026-1768262917 No score

TuxCare security update for 6 packages (22 CVEs)

TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.

Record
CLSA-2026-1768262917
Updated
2026-11-02
OSVCLSA-2026-1768821437 No score

pki-servlet-engine: Fix of 2 CVEs

  • CVE-2025-31651: fix improper neutralization of escape, meta, or control sequences
  • CVE-2025-55752: fix relative path traversal vulnerability
Record
CLSA-2026-1768821437
Updated
2026-11-02
OSVCLSA-2026-1769701085 No score

pki-servlet-engine: Fix of CVE-2025-31651

  • CVE-2025-31651: fix improper neutralization of escape, meta or control sequences to avoid bypassing rewrite rules
Record
CLSA-2026-1769701085
Updated
2026-11-02
OSVCLSA-2026-1770768569 No score

TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 9.0.50-tuxcare.4.

Record
CLSA-2026-1770768569
Updated
2026-11-02
OSVCLSA-2026-1773188120 No score

TuxCare security update for 5 packages (23 CVEs)

TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.

Record
CLSA-2026-1773188120
Updated
2026-11-02
OSVCLSA-2026-1786096120 No score

TuxCare security update for 3 packages (3 CVEs)

TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 9.0.83-tuxcare.4.

Record
CLSA-2026-1786096120
Updated
2026-11-02
OSVCLSA-2026-1786542969 No score

Fix CVE(s): CVE-2025-31651

  • SECURITY UPDATE: rewrite rule bypass with encoded characters
    • debian/patches/CVE-2025-31651.patch: encode literal '%', ';' and '?' in the URL before the rewrite rules are evaluated and treat '%' as safe when re-encoding afterwards in java/org/apache/catalina/valves/rewrite/RewriteValve.java, stop truncating the decoded URI at the first ';' when a rewritten request is re-dispatched in java/org/apache/catalina/connector/CoyoteAdapter.java, add tests to test/org/apache/catalina/valves/rewrite/TestRewriteValve.java
    • CVE-2025-31651
Record
CLSA-2026-1786542969
Updated
2026-11-02
OSVCLSA-2026-1793134796 No score

TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 7.0.109-tuxcare.6.

Record
CLSA-2026-1793134796
Updated
2026-11-02
OSVCLSA-2026-1793202343 No score

TuxCare security update for 3 packages (5 CVEs)

TuxCare rebuilt 3 packages to address 5 CVEs. Fixed in 10.1.33-tuxcare.2.

Record
CLSA-2026-1793202343
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat-catalina
Maven
 9.0.76 to 9.0.102
9.0.104
org.apache.tomcat:tomcat-catalina
Maven
 10.1.10 up to 10.1.40
10.1.40
org.apache.tomcat:tomcat-catalina
Maven
 11.0.0-M2 up to 11.0.6
11.0.6
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.76 to 9.0.102
9.0.104
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.10 up to 10.1.40
10.1.40
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M2 up to 11.0.6
11.0.6
org.apache.tomcat:tomcat-catalina
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100 None known
tomcat
AlmaLinux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat-admin-webapps
AlmaLinux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
Show 290 moreShow less
Affected packages
PackageAffectedFixed
tomcat-docs-webapp
AlmaLinux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat-el-3.0-api
AlmaLinux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat-jsp-2.3-api
AlmaLinux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat-lib
AlmaLinux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat-servlet-4.0-api
AlmaLinux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat-webapps
AlmaLinux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat
AlmaLinux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat-admin-webapps
AlmaLinux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat-docs-webapp
AlmaLinux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat-el-3.0-api
AlmaLinux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat-jsp-2.3-api
AlmaLinux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat-lib
AlmaLinux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat-servlet-4.0-api
AlmaLinux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat-webapps
AlmaLinux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat
AlmaLinux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat-admin-webapps
AlmaLinux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat-docs-webapp
AlmaLinux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat-el-5.0-api
AlmaLinux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat-jsp-3.1-api
AlmaLinux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat-lib
AlmaLinux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat-servlet-6.0-api
AlmaLinux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat-webapps
AlmaLinux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat9
AlmaLinux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
tomcat9-admin-webapps
AlmaLinux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
tomcat9-docs-webapp
AlmaLinux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
tomcat9-el-3.0-api
AlmaLinux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
tomcat9-jsp-2.3-api
AlmaLinux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
tomcat9-lib
AlmaLinux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
tomcat9-servlet-4.0-api
AlmaLinux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
tomcat9-webapps
AlmaLinux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
tomcat
Bitnami
 before 9.0.104, 10.0.0 up to 10.1.40, 11.0.0 up to 11.0.6
9.0.10410.1.4011.0.6
libtomcat9-embed-java
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els13
9.0.16-3ubuntu0.18.04.2+tuxcare.els13
libtomcat9-java
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els13
9.0.16-3ubuntu0.18.04.2+tuxcare.els13
tomcat9
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els13
9.0.16-3ubuntu0.18.04.2+tuxcare.els13
tomcat9-admin
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els13
9.0.16-3ubuntu0.18.04.2+tuxcare.els13
tomcat9-common
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els13
9.0.16-3ubuntu0.18.04.2+tuxcare.els13
tomcat9-docs
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els13
9.0.16-3ubuntu0.18.04.2+tuxcare.els13
tomcat9-examples
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els13
9.0.16-3ubuntu0.18.04.2+tuxcare.els13
tomcat9-user
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els13
9.0.16-3ubuntu0.18.04.2+tuxcare.els13
tomcat
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els12
1:9.0.62-11.el9_2.3.tuxcare.els12
tomcat-admin-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els12
1:9.0.62-11.el9_2.3.tuxcare.els12
tomcat-docs-webapp
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els12
1:9.0.62-11.el9_2.3.tuxcare.els12
tomcat-el-3.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els12
1:9.0.62-11.el9_2.3.tuxcare.els12
tomcat-jsp-2.3-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els12
1:9.0.62-11.el9_2.3.tuxcare.els12
tomcat-lib
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els12
1:9.0.62-11.el9_2.3.tuxcare.els12
tomcat-servlet-4.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els12
1:9.0.62-11.el9_2.3.tuxcare.els12
tomcat-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els12
1:9.0.62-11.el9_2.3.tuxcare.els12
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 8.5.100 up to 8.5.100.tuxcare.1
8.5.100.tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 8.5.100 up to 8.5.100.tuxcare.1
8.5.100.tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 8.5.100 up to 8.5.100.tuxcare.1
8.5.100.tuxcare.1
libtomcat9-embed-java
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els1
9.0.31-1ubuntu0.9+tuxcare.els1
libtomcat9-java
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els1
9.0.31-1ubuntu0.9+tuxcare.els1
tomcat9
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els1
9.0.31-1ubuntu0.9+tuxcare.els1
tomcat9-admin
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els1
9.0.31-1ubuntu0.9+tuxcare.els1
tomcat9-common
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els1
9.0.31-1ubuntu0.9+tuxcare.els1
tomcat9-docs
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els1
9.0.31-1ubuntu0.9+tuxcare.els1
tomcat9-examples
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els1
9.0.31-1ubuntu0.9+tuxcare.els1
tomcat9-user
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els1
9.0.31-1ubuntu0.9+tuxcare.els1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.75 up to 9.0.75-tuxcare.1
9.0.75-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.75 up to 9.0.75-tuxcare.1
9.0.75-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 9.0.75 up to 9.0.75-tuxcare.1
9.0.75-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.75 up to 9.0.75-tuxcare.1
9.0.75-tuxcare.1
org.apache.tomcat:tomcat-util
TuxCare:Maven
 9.0.75 up to 9.0.75-tuxcare.1
9.0.75-tuxcare.1
libtomcat9-embed-java
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els3
9.0.31-1~deb10u12+tuxcare.els3
libtomcat9-java
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els3
9.0.31-1~deb10u12+tuxcare.els3
tomcat9
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els3
9.0.31-1~deb10u12+tuxcare.els3
tomcat9-admin
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els3
9.0.31-1~deb10u12+tuxcare.els3
tomcat9-common
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els3
9.0.31-1~deb10u12+tuxcare.els3
tomcat9-docs
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els3
9.0.31-1~deb10u12+tuxcare.els3
tomcat9-examples
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els3
9.0.31-1~deb10u12+tuxcare.els3
tomcat9-user
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els3
9.0.31-1~deb10u12+tuxcare.els3
tomcat
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els1
1:9.0.87-3.el9_6.3.tuxcare.els1
tomcat-admin-webapps
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els1
1:9.0.87-3.el9_6.3.tuxcare.els1
tomcat-docs-webapp
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els1
1:9.0.87-3.el9_6.3.tuxcare.els1
tomcat-el-3.0-api
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els1
1:9.0.87-3.el9_6.3.tuxcare.els1
tomcat-jsp-2.3-api
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els1
1:9.0.87-3.el9_6.3.tuxcare.els1
tomcat-lib
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els1
1:9.0.87-3.el9_6.3.tuxcare.els1
tomcat-servlet-4.0-api
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els1
1:9.0.87-3.el9_6.3.tuxcare.els1
tomcat-webapps
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els1
1:9.0.87-3.el9_6.3.tuxcare.els1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.87 up to 9.0.87-tuxcare.1
9.0.87-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.100 up to 9.0.100-tuxcare.1
9.0.100-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
 10.1.18 up to 10.1.18-tuxcare.1
10.1.18-tuxcare.1
pki-servlet-4.0-api
TuxCare:AlmaLinux:9.6
 before 1:9.0.50-1.el9_2.2.tuxcare.els1
1:9.0.50-1.el9_2.2.tuxcare.els1
pki-servlet-engine
TuxCare:AlmaLinux:9.6
 before 1:9.0.50-1.el9_2.2.tuxcare.els1
1:9.0.50-1.el9_2.2.tuxcare.els1
pki-servlet-4.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.50-1.el9.tuxcare.els3
1:9.0.50-1.el9.tuxcare.els3
pki-servlet-engine
TuxCare:AlmaLinux:9.2
 before 1:9.0.50-1.el9.tuxcare.els3
1:9.0.50-1.el9.tuxcare.els3
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.50 up to 9.0.50-tuxcare.4, plus listed versions
9.0.50-tuxcare.19.0.50-tuxcare.29.0.50-tuxcare.3
9.0.50-tuxcare.4
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 9.0.50 up to 9.0.50-tuxcare.4, plus listed versions
9.0.50-tuxcare.19.0.50-tuxcare.29.0.50-tuxcare.3
9.0.50-tuxcare.4
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat:tomcat-util
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.1
9.0.46-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.83 up to 9.0.83-tuxcare.4, plus listed versions
9.0.83-tuxcare.19.0.83-tuxcare.29.0.83-tuxcare.3
9.0.83-tuxcare.4
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.83 up to 9.0.83-tuxcare.4, plus listed versions
9.0.83-tuxcare.19.0.83-tuxcare.29.0.83-tuxcare.3
9.0.83-tuxcare.4
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 9.0.83 up to 9.0.83-tuxcare.4, plus listed versions
9.0.83-tuxcare.19.0.83-tuxcare.29.0.83-tuxcare.3
9.0.83-tuxcare.4
libservlet3.1-java
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
libservlet3.1-java-doc
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
libtomcat8-java
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
tomcat8
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
tomcat8-admin
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
tomcat8-common
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
tomcat8-docs
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
tomcat8-examples
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
tomcat8-user
TuxCare:Ubuntu:16.04
 before 8.0.32-1ubuntu1.13+tuxcare.els4
8.0.32-1ubuntu1.13+tuxcare.els4
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 7.0.109 up to 7.0.109-tuxcare.6, plus listed versions
7.0.109-tuxcare.17.0.109-tuxcare.27.0.109-tuxcare.37.0.109-tuxcare.47.0.109-tuxcare.5
7.0.109-tuxcare.6
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 7.0.109 up to 7.0.109-tuxcare.6, plus listed versions
7.0.109-tuxcare.17.0.109-tuxcare.27.0.109-tuxcare.37.0.109-tuxcare.47.0.109-tuxcare.5
7.0.109-tuxcare.6
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 10.1.33 up to 10.1.33-tuxcare.2, plus listed versions
10.1.33-tuxcare.1
10.1.33-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
 10.1.33 up to 10.1.33-tuxcare.2, plus listed versions
10.1.33-tuxcare.1
10.1.33-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 10.1.33 up to 10.1.33-tuxcare.2, plus listed versions
10.1.33-tuxcare.1
10.1.33-tuxcare.2
tomcat10
Debian:12
 before 10.1.40-1, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 21 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-1~bpo12+110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.40-1
tomcat10
Debian:13
 before 10.1.40-1
10.1.40-1
tomcat10
Debian:14
 before 10.1.40-1
10.1.40-1
tomcat11
Debian:13
 before 11.0.6-1
11.0.6-1
tomcat11
Debian:14
 before 11.0.6-1
11.0.6-1
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:11
 before 9.0.107-0+deb11u1, plus listed versions
9.0.43-19.0.43-29.0.43-2~deb11u19.0.43-2~deb11u109.0.43-2~deb11u11
Show 25 moreShow less
9.0.43-2~deb11u129.0.43-2~deb11u29.0.43-2~deb11u39.0.43-2~deb11u49.0.43-2~deb11u59.0.43-2~deb11u69.0.43-2~deb11u79.0.43-2~deb11u89.0.43-2~deb11u99.0.43-39.0.53-19.0.54-19.0.55-19.0.58-19.0.62-19.0.63-19.0.64-19.0.64-29.0.65-19.0.67-19.0.68-19.0.68-1.19.0.70-19.0.70-29.0.95-1
9.0.107-0+deb11u1
org.apache.tomcat:tomcat-catalina
Maven
 9.0.76 up to 9.0.104, plus listed versions
9.0.1009.0.1029.0.789.0.799.0.80
Show 18 moreShow less
9.0.819.0.829.0.839.0.849.0.859.0.869.0.879.0.889.0.899.0.909.0.919.0.939.0.949.0.959.0.969.0.979.0.989.0.99
9.0.104
org.apache.tomcat:tomcat-catalina
Maven
 10.1.10 up to 10.1.40, plus listed versions
10.1.1110.1.1210.1.1310.1.1410.1.15
Show 18 moreShow less
10.1.1610.1.1710.1.1810.1.1910.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.39
10.1.40
org.apache.tomcat:tomcat-catalina
Maven
 11.0.0-M2 up to 11.0.6, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 23 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.5
11.0.6
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.76 up to 9.0.104, plus listed versions
9.0.1009.0.1029.0.789.0.799.0.80
Show 18 moreShow less
9.0.819.0.829.0.839.0.849.0.859.0.869.0.879.0.889.0.899.0.909.0.919.0.939.0.949.0.959.0.969.0.979.0.989.0.99
9.0.104
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.10 up to 10.1.40, plus listed versions
10.1.1110.1.1210.1.1310.1.1410.1.15
Show 18 moreShow less
10.1.1610.1.1710.1.1810.1.1910.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.39
10.1.40
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M2 up to 11.0.6, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 23 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.5
11.0.6
org.apache.tomcat:tomcat-catalina
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
tomcat
Mageia:9
 before 9.0.104-1.mga9
9.0.104-1.mga9
tomcat
openEuler:22.03-LTS-SP4
 before 9.0.100-2.oe2203sp4
9.0.100-2.oe2203sp4
tomcat
openEuler:24.03-LTS
 before 9.0.100-2.oe2403sp1
9.0.100-2.oe2403sp1
tomcat
openEuler:24.03-LTS-SP1
 before 9.0.100-2.oe2403sp1
9.0.100-2.oe2403sp1
tomcat
openEuler:20.03-LTS-SP4
 before 9.0.100-2.oe2003sp4
9.0.100-2.oe2003sp4
tomcat
openEuler:22.03-LTS-SP3
 before 9.0.100-2.oe2203sp3
9.0.100-2.oe2203sp3
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-19.redhat_00018.1.el10jws
0:10.1.36-19.redhat_00018.1.el10jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-19.redhat_00018.1.el8jws
0:10.1.36-19.redhat_00018.1.el8jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-19.redhat_00018.1.el9jws
0:10.1.36-19.redhat_00018.1.el9jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-java-jdk11
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-java-jdk8
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-14.redhat_00013.1.el7jws
0:9.0.87-14.redhat_00013.1.el7jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-14.redhat_00013.1.el8jws
0:9.0.87-14.redhat_00013.1.el8jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-14.redhat_00013.1.el9jws
0:9.0.87-14.redhat_00013.1.el9jws
tomcat
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.87-3.el9_6.4
1:9.0.87-3.el9_6.4
tomcat-admin-webapps
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.87-3.el9_6.4
1:9.0.87-3.el9_6.4
tomcat-docs-webapp
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.87-3.el9_6.4
1:9.0.87-3.el9_6.4
tomcat-el-3.0-api
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.87-3.el9_6.4
1:9.0.87-3.el9_6.4
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.87-3.el9_6.4
1:9.0.87-3.el9_6.4
tomcat-lib
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.87-3.el9_6.4
1:9.0.87-3.el9_6.4
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.87-3.el9_6.4
1:9.0.87-3.el9_6.4
tomcat-webapps
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.87-3.el9_6.4
1:9.0.87-3.el9_6.4
tomcat
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-admin-webapps
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-docs-webapp
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-el-3.0-api
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-lib
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-webapps
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-admin-webapps
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-docs-webapp
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-el-3.0-api
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-jsp-2.3-api
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-lib
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-servlet-4.0-api
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat-webapps
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.8
1:9.0.87-1.el8_8.8
tomcat
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.7
1:9.0.87-1.el9_2.7
tomcat-admin-webapps
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.7
1:9.0.87-1.el9_2.7
tomcat-docs-webapp
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.7
1:9.0.87-1.el9_2.7
tomcat-el-3.0-api
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.7
1:9.0.87-1.el9_2.7
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.7
1:9.0.87-1.el9_2.7
tomcat-lib
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.7
1:9.0.87-1.el9_2.7
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.7
1:9.0.87-1.el9_2.7
tomcat-webapps
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.7
1:9.0.87-1.el9_2.7
tomcat
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.7
1:9.0.87-1.el9_4.7
tomcat-admin-webapps
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.7
1:9.0.87-1.el9_4.7
tomcat-docs-webapp
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.7
1:9.0.87-1.el9_4.7
tomcat-el-3.0-api
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.7
1:9.0.87-1.el9_4.7
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.7
1:9.0.87-1.el9_4.7
tomcat-lib
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.7
1:9.0.87-1.el9_4.7
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.7
1:9.0.87-1.el9_4.7
tomcat-webapps
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.7
1:9.0.87-1.el9_4.7
tomcat
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat-admin-webapps
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat
Rocky Linux:8
 before 1:9.0.87-1.el8_10.7
1:9.0.87-1.el8_10.7
tomcat
Rocky Linux:9
 before 1:9.0.87-6.el9_7.1
1:9.0.87-6.el9_7.1
tomcat
Rocky Linux:10
 before 1:10.1.36-3.el10_1.1
1:10.1.36-3.el10_1.1
tomcat9
Rocky Linux:10
 before 1:9.0.87-8.el10_1.1
1:9.0.87-8.el10_1.1
org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.16-aikido.9
10.1.16-aikido.910.1.30-aikido.710.1.39-aikido.169.0.99-aikido.39.0.100-aikido.210.1.30-aikido.810.1.30-aikido.910.1.16-aikido.1010.1.39-aikido.1710.1.34-aikido.510.1.39-aikido.1810.1.30-aikido.1010.1.34-aikido.69.0.100-aikido.310.1.16-aikido.119.0.99-aikido.410.1.39-aikido.1910.1.30-aikido.1110.1.30-aikido.1210.1.16-aikido.1210.1.39-aikido.2010.1.30-aikido.1310.1.34-aikido.7
org.apache.tomcat:tomcat-catalina
Root:Maven
 before 10.1.13-aikido.12
10.1.13-aikido.1211.0.6-aikido.5
io.root.org.apache.tomcat:tomcat-catalina
Root:Maven
 before 10.1.13-root.io.3
10.1.13-root.io.310.1.13-root.io.410.1.13-root.io.510.1.13-root.io.610.1.13-root.io.710.1.13-root.io.810.1.13-root.io.910.1.13-root.io.1010.1.13-root.io.1110.1.13-root.io.1211.0.6-root.io.111.0.6-root.io.211.0.6-root.io.311.0.6-root.io.411.0.6-root.io.5
io.root.org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.39-root.io.5
10.1.39-root.io.510.1.39-root.io.610.1.39-root.io.710.1.39-root.io.810.1.39-root.io.910.1.39-root.io.1010.1.39-root.io.1110.1.39-root.io.1210.1.34-root.io.110.1.30-root.io.110.1.34-root.io.210.1.39-root.io.1310.1.16-root.io.310.1.16-root.io.410.1.39-root.io.1410.1.16-root.io.510.1.30-root.io.210.1.30-root.io.310.1.16-root.io.610.1.30-root.io.410.1.16-root.io.710.1.39-root.io.1510.1.34-root.io.39.0.99-root.io.19.0.99-root.io.29.0.100-root.io.110.1.16-root.io.810.1.30-root.io.510.1.30-root.io.610.1.39-root.io.1810.1.16-root.io.910.1.30-root.io.710.1.39-root.io.169.0.99-root.io.39.0.100-root.io.210.1.30-root.io.810.1.30-root.io.910.1.16-root.io.1010.1.39-root.io.1710.1.34-root.io.510.1.30-root.io.1010.1.34-root.io.69.0.100-root.io.310.1.16-root.io.119.0.99-root.io.410.1.39-root.io.1910.1.30-root.io.1110.1.30-root.io.1210.1.16-root.io.1210.1.39-root.io.2010.1.30-root.io.1310.1.34-root.io.7
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 10.1.40-150200.5.40.1
10.1.40-150200.5.40.1
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 9.0.36-3.142.1
9.0.36-3.142.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Manager Server 4.3
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
SUSE:Enterprise Storage 7.1
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat
openSUSE:Leap 15.6
 before 9.0.104-150200.81.1
9.0.104-150200.81.1
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
 before 10.1.40-150200.5.40.1
10.1.40-150200.5.40.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 10.1.40-150200.5.40.1
10.1.40-150200.5.40.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 10.1.40-150200.5.40.1
10.1.40-150200.5.40.1
tomcat10
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 10.1.40-150200.5.40.1
10.1.40-150200.5.40.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 10.1.40-150200.5.40.1
10.1.40-150200.5.40.1
tomcat10
openSUSE:Leap 15.6
 before 10.1.40-150200.5.40.1
10.1.40-150200.5.40.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat8
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1
Show 14 moreShow less
8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.48.0.32-1ubuntu1.58.0.32-1ubuntu1.68.0.32-1ubuntu1.78.0.32-1ubuntu1.88.0.32-1ubuntu1.98.0.32-1ubuntu1.108.0.32-1ubuntu1.118.0.32-1ubuntu1.138.0.32-1ubuntu1.13+esm18.0.32-1ubuntu1.13+esm2
 None known
tomcat8
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2
Show 11 moreShow less
8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6
 None known
tomcat9
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2
Show 6 moreShow less
9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8
 None known
tomcat9
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2
Show 10 moreShow less
9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3
 None known
tomcat9
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1
Show 9 moreShow less
9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4
 None known
tomcat10
Ubuntu:Pro:24.04:LTS
 before 10.1.16-1ubuntu0.1~esm3, plus listed versions
10.1.10-110.1.14-110.1.15-110.1.16-110.1.16-1ubuntu0.1~esm110.1.16-1ubuntu0.1~esm2
10.1.16-1ubuntu0.1~esm3
tomcat
openSUSE:Tumbleweed
 before 9.0.104-1.1
9.0.104-1.1
tomcat10
openSUSE:Tumbleweed
 before 10.1.40-1.1
10.1.40-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubgregk4sec/CVE-2025-31651-o2025-04-08
PoC in GitHubgregk4sec/cve-2025-316512026-03-09

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-31651 is a critical vulnerability (CVSS 9.8) in Apache Tomcat, published April 28, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.26%, the 91st percentile. Fixed in org.apache.tomcat:tomcat-catalina 9.0.104.

References

Show 157 moreShow less
This page doesn't list everything

Left out here: 307 package rows and 66 versions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 11 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open