Overview
Apache Tomcat is an open-source web server and servlet container developed by the Apache Software Foundation. It implements several Java Enterprise Edition (Java EE) specifications including Java Servlet, JavaServer Pages (JSP), and WebSocket, allowing it to run Java web applications. Tomcat is widely used in both development and production environments due to its lightweight nature, ease of configuration, and compatibility with various Java applications.
An Improper Encoding or Escaping of Output / Improper Neutralization of Leading Special Elements vulnerability (CVE-2025-31651) has been identified in Apache Tomcat. This vulnerability allows certain rewrite rules to be bypassed under certain configurations. When those rewrite rules are used for security, those security methods are susceptible to bypass as well.
Per Mitre: An Information Disclosure vulnerability is a security flaw that allows unauthorized users to access sensitive information that should be kept private.
Per Mitre: An Improper Neutralization of Leading Special Elements vulnerability is a security flaw that can cause a process to take unexpected actions when leading special elements are improperly handled.
This issue affects multiple versions of Apache Tomcat below 11.0.6.
Details
Module Info
- Product: Apache Tomcat
- Affected packages: tomcat-embed-core, tomcat-catalina
- Affected versions: >=9.0.76 <9.0.104, >=10.1.10 <10.1.40, >=11.0.0-M2 <11.0.6
- GitHub repository: https://github.com/apache/tomcat
- Published packages:
- Package manager: Maven
- Fixed in: NES 8.5.101, 9.0.104, 10.1.40, and 11.0.6
Vulnerability Info
The problem lies in the Tomcat RewriteRule. Under certain unlikely configurations, attackers of vulnerable applications can use characters like ; or ? to bypass rewrite rules, potentially bypassing security constraints and gaining access to protected resources.
Mitigation
Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade to a patched version of Apache Tomcat.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
- COSCO Shipping Lines DIC (finder)
