CVE-2025-31651: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of

Q: How do I fix CVE-2025-31651?

tomcat: upgrade to 9.0.104, 10.1.40, 11.0.6. Exact commands for each OS are on this page.

Q: Is CVE-2025-31651 being exploited?

CVE-2025-31651 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2025-31651 affect?

CVE-2025-31651 affects tomcat. Severity is critical (CVSS 9.8). Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rew

Q: How urgent is CVE-2025-31651?

Priority 70/100. Critical severity; EPSS top 9%: very likely to be exploited; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

This week

CRITICAL 9.8REMOTEWATCHLISTUPGRADE

CVE-2025-31651 is a critical-severity flaw (CVSS 9.8) affecting tomcat. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 throug

Why this priority

Critical severity
EPSS top 9%: very likely to be exploited
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	4.3% (top 9%)
CISA exploited list	No
Weakness	CWE-116
Published	2025-04-28
Last modified	2026-06-17

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-04-28 20:15 UTCPublished CVE record published
2026-06-17 09:10 UTCUpdated Record last modified

apache tomcat UPGRADE

Affected: >= 9.0.0 and < 9.0.104 · >= 10.1.0 and < 10.1.40 · >= 11.0.0 and < 11.0.6

Fixed in: 9.0.104, 10.1.40, 11.0.6

Safe to downgrade to: a release before 9.0.0

1. Check installed version

apt-cache policy tomcat || rpm -q tomcat || tomcat --version

2. UPGRADE to 9.0.104 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade tomcat

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade tomcat

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 9.0.0 (Debian / Ubuntu)

apt-cache madison tomcat sudo apt install tomcat=<VERSION_BEFORE_9.0.0> sudo apt-mark hold tomcat

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list tomcat sudo dnf downgrade tomcat-<VERSION_BEFORE_9.0.0> sudo dnf versionlock add tomcat

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Maven · org.apache.tomcat:tomcat-catalina · FIXED · 9.0.104 · vulnerable: >= 9.0.76, <= 9.0.102 · source

Set org.apache.tomcat:tomcat-catalina to 9.0.104 or later in pom.xml or build.gradle, then rebuild and redeploy.

Maven · org.apache.tomcat.embed:tomcat-embed-core · FIXED · 9.0.104 · vulnerable: >= 9.0.76, <= 9.0.102 · source

Set org.apache.tomcat.embed:tomcat-embed-core to 9.0.104 or later in pom.xml or build.gradle, then rebuild and redeploy.

Fedora ELN · ibus-typing-booster · FIXED · 2.31.3-1.eln159 · FEDORA-2026-c895c68d60 · source

sudo dnf upgrade --advisory=FEDORA-2026-c895c68d60

Fedora 46 · perl-WWW-OrangeHRM-Client · FIXED · 0.12.0-21.fc46 · FEDORA-2026-2d14efca09 · source

sudo dnf upgrade --advisory=FEDORA-2026-2d14efca09

Debian 12 · tomcat10 · FIXED · 10.1.40-1

sudo apt update && sudo apt install --only-upgrade tomcat10 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat10)" ge "10.1.40-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · tomcat10 · FIXED · 10.1.40-1

sudo apt update && sudo apt install --only-upgrade tomcat10 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat10)" ge "10.1.40-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · tomcat11 · FIXED · 11.0.6-1

sudo apt update && sudo apt install --only-upgrade tomcat11 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat11)" ge "11.0.6-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · tomcat9 · FIXED · 9.0.70-2

sudo apt update && sudo apt install --only-upgrade tomcat9 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat9)" ge "9.0.70-2" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · tomcat · FIXED · tomcat-10.1.36-3.el10_1.1

sudo dnf upgrade --advisory=RHSA-2025:23050 rpm -q tomcat

RHEL 10 · tomcat9 · FIXED · tomcat9-9.0.87-8.el10_1.1

sudo dnf upgrade --advisory=RHSA-2025:23052 rpm -q tomcat9

RHEL 10.0 Extended Update Support · tomcat · FIXED · tomcat-10.1.36-1.el10_0.3

sudo dnf upgrade --advisory=RHSA-2025:23051 rpm -q tomcat

RHEL 10.0 Extended Update Support · tomcat9 · FIXED · tomcat9-9.0.87-5.el10_0.4

sudo dnf upgrade --advisory=RHSA-2025:23053 rpm -q tomcat9

RHEL 8 · tomcat · FIXED · tomcat-9.0.87-1.el8_10.7

sudo dnf upgrade --advisory=RHSA-2025:23048 rpm -q tomcat

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2025-965 · source

sudo dnf update --advisory=ALAS2023-2025-965

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: gregk4sec/CVE-2025-31651-o (2 stars)
GitHub PoC: gregk4sec/cve-2025-31651 (0 stars)
GitHub PoC: gregk4sec/CVE-2025-31651

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-31651?

tomcat: upgrade to 9.0.104, 10.1.40, 11.0.6. Exact commands for each OS are on this page.

Is CVE-2025-31651 being exploited?

CVE-2025-31651 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-31651 affect?

CVE-2025-31651 affects tomcat. Severity is critical (CVSS 9.8). Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rew

How urgent is CVE-2025-31651?

Priority 70/100. Critical severity; EPSS top 9%: very likely to be exploited; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

Software pages

Apache Tomcat vulnerabilities

Related CVEs

CVE-2026-34486 HIGH 7.5 EXPLOITED DOWNGRADE DOWNGRADE Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
CVE-2026-29146 HIGH 7.5 UPGRADE Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue aff
CVE-2026-25854 MEDIUM 6.1 UPGRADE Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBala
CVE-2026-29145 CRITICAL 9.1 UPGRADE UPGRADE CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerabili
CVE-2026-24880 HIGH 7.5 UPGRADE Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomca

References

← Back to latest CVEs