CVE-2025-31651

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.5 Apache Tomcat versions 10.1.0-M1 through 10.1.39 Apache Tomcat versions 9.0.0.M1 through 9.0.102

Description The issue is related to the improper neutralization of escape, meta, or control sequences in Apache Tomcat, which could allow a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

Recommendations Upgrade to version [FIXED VERSION] to fix the issue for Apache Tomcat versions 11.0.0-M1 through 11.0.5 Upgrade to version [FIXED VERSION] to fix the issue for Apache Tomcat versions 10.1.0-M1 through 10.1.39 Upgrade to version [FIXED VERSION] to fix the issue for Apache Tomcat versions 9.0.0.M1 through 9.0.102