CVE-2025-31651

An error classified as CWE-116 (Improper Neutralization of Escape, Meta, or Control Sequences) affects the rewrite rules processing mechanism in Apache Tomcat. An attacker may send a specially crafted HTTP request which, in certain though unlikely rewrite rule configurations, causes their bypass. If such rules were the only layer of access control or other security policy, it is possible to circumvent them without any privileges or user interaction.

An attacker may bypass security restrictions enforced by rewrite rules, potentially leading to unauthorized access to protected resources, breach of confidentiality, integrity, and availability of the application.

Apache Tomcat should be updated to patched versions indicated in vendor references (announcement available at lists.apache.org). The vulnerability affects only configurations using rewrite rules — organizations not using the rewrite module are at lower risk. It is recommended to review existing rewrite rules for enforcement of critical security restrictions.

Apache Tomcat in versions: 11.0.0-M1 to 11.0.5, 10.1.0-M1 to 10.1.39, 9.0.0.M1 to 9.0.102. Version 8.5.0–8.5.100 is marked as EOL but also vulnerable. Older EOL versions may also be affected.