Apache Tomcat up to 9.0.102/10.1.39/11.0.5 Rewrite Rule control sequence

Summaryinfo

A vulnerability marked as problematic has been reported in Apache Tomcat up to 9.0.102/10.1.39/11.0.5. This affects an unknown part of the component Rewrite Rule Handler. Performing a manipulation results in control sequence. This vulnerability is cataloged as CVE-2025-31651. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Tomcat up to 9.0.102/10.1.39/11.0.5. It has been classified as problematic. This affects an unknown code of the component Rewrite Rule Handler. The manipulation with an unknown input leads to a control sequence vulnerability. CWE is classifying the issue as CWE-150. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component. This is going to have an impact on integrity. The summary by CVE is:

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2025-31651 since 03/31/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/13/2025).

The vulnerability scanner Nessus provides a plugin with the ID 235034 (Apache Tomcat 9.0.0.M1 < 9.0.104 multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0.104, 10.1.40 or 11.0.6 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (235034), EUVD (EUVD-2025-13626) and CERT Bund (WID-SEC-2025-0895). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• IBM Security Guardium
• Debian Linux
• Amazon Linux 2
• IBM Power Hardware Management Console
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Red Hat JBoss Web Server
• Oracle Linux
• RESF Rocky Linux
• Atlassian Confluence
• Apache Tomcat
• Atlassian Bamboo
• IBM Integration Bus
• Atlassian Jira
• Trellix ePolicy Orchestrator
• HCL Commerce
• Dell NetWorker
• SAS Institute Base SAS

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 9.0.102
• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.1.12
• 10.1.13
• 10.1.14
• 10.1.15
• 10.1.16
• 10.1.17
• 10.1.18
• 10.1.19
• 10.1.20
• 10.1.21
• 10.1.22
• 10.1.23
• 10.1.24
• 10.1.25
• 10.1.26
• 10.1.27
• 10.1.28
• 10.1.29
• 10.1.30
• 10.1.31
• 10.1.32
• 10.1.33
• 10.1.34
• 10.1.35
• 10.1.36
• 10.1.37
• 10.1.38
• 10.1.39
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion