CVE-2025-46701
Apache Tomcat: Security constraint bypass for CGI scripts
HIGH 7.3
At a glance
- Source
- NVD
- EPSS
- EPSS 3.14 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.
Weaknesses (CWE)
- CWE-178 — Improper Handling of Case Sensitivity
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | CISA-ADP |
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-h2fw-rfh5-95r3 — Apache Tomcat - CGI security constraint bypass
European references
- ENISA EUVD · EUVD-2025-16411
- GCVE · GCVE-0-2025-46701
CERT-FR advisories
- CERTFR-2026-AVI-0322 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0281 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0754 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0593 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0585 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0530 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0524 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0461 — Vulnérabilité dans Apache Tomcat · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.105cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 10.1.0 < 10.1.41cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 11.0.0 < 11.0.7
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat | affected 11.0.0-M1 ≤ 11.0.6 ; affected 10.1.0-M1 ≤ 10.1.40 ; affected 9.0.0.M1 ≤ 9.0.104 ; affected 8.5.0 ≤ 8.5.100 ; unknown 3 < 8.5.0 ; unknown 10.0.0-M1 ≤ 10.0.27 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |