Apache Tomcat up to 11.0.10 on Windows control sequence

Summaryinfo

A vulnerability marked as critical has been reported in Apache Tomcat up to 8.4.x/8.5.100/9.0.108/10.1.44/11.0.10 on Windows. Impacted is an unknown function. Performing a manipulation results in control sequence. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is cataloged as CVE-2025-55754. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apache Tomcat up to 8.4.x/8.5.100/9.0.108/10.1.44/11.0.10 on Windows. This affects an unknown code. The manipulation with an unknown input leads to a control sequence vulnerability. CWE is classifying the issue as CWE-150. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

The weakness was shared by Elysee Franchuk. It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2025-55754 since 08/15/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/08/2026).

The vulnerability scanner Nessus provides a plugin with the ID 271693 (Apache Tomcat 11.0.0.M1 < 11.0.11 multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0.109, 10.1.45 or 11.0.11 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (271693) and CERT Bund (WID-SEC-2025-2420). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Red Hat JBoss Web Server
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Apache Tomcat
• IBM QRadar SIEM
• IBM Integration Bus
• Open Source Camunda
• Absolute Secure Access

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5.100
• 9.0.108
• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.1.12
• 10.1.13
• 10.1.14
• 10.1.15
• 10.1.16
• 10.1.17
• 10.1.18
• 10.1.19
• 10.1.20
• 10.1.21
• 10.1.22
• 10.1.23
• 10.1.24
• 10.1.25
• 10.1.26
• 10.1.27
• 10.1.28
• 10.1.29
• 10.1.30
• 10.1.31
• 10.1.32
• 10.1.33
• 10.1.34
• 10.1.35
• 10.1.36
• 10.1.37
• 10.1.38
• 10.1.39
• 10.1.40
• 10.1.41
• 10.1.42
• 10.1.43
• 10.1.44
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.0.10

License

• open-source

Support

• end of life

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion