- 118/2025
- High
Apache has released security updates to address several vulnerabilities affecting multiple Apache Tomcat versions.
The addressed vulnerabilities could allow the remote attacker to perform denial of service attacks or bypass security restrictions on the affected systems.
Sample of the addressed vulnerabilities:
Apache Tomcat CGI Security Constraint Security Bypass Vulnerability (CVE-2025- 46701):
- CVSS: 7.3
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Bypass Security
Sample of the affected products:
- Apache Tomcat 11.0.0-M1 to 11.0.6.
- Apache Tomcat 10.1.0-M1 to 10.1.40.
- Apache Tomcat 9.0.0.M1 to 9.0.104.
Vulnerabilities
- CVE-2025-46701
- CVE-2025-31651
- CVE-2025-31650
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.