This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apache Tomcat fixes 3 vulnerabilities

Apache Tomcat versions 11.0.12, 10.1.47 and 9.0.110 fix 3 vulnerabilities [1][2][3]. For the stable Debian release, security fixes were issued only in the tomcat9 package in version 9.0.107-0+deb11u1 for bullseye (security) and in version 9.0.70-2 for bookworm [4][5][6]. Red Hat [7][8][9] and Ubuntu have not yet provided fixes, or their releases are not affected by the vulnerabilities [10][11][12]. Gentoo has fixed versions available as testing for the most common architectures [13].

Apache Tomcat - console manipulation, command execution (CVE-2025-55754)
CVSS 9.6 (Critical)

Using a specially crafted URL, an unauthenticated remote attacker can inject ANSI escape sequences into the Tomcat logs that manipulate the console and clipboard, thereby tricking an administrator into executing an attacker-controlled command. Exploitability has been confirmed only on Windows machines where ANSI escape sequence support is enabled. However, the possibility of similar exploitation on other operating systems cannot be ruled out [1].

The vulnerability is present in product:

  • Apache Tomcat; >=8.5.60, <=8.5.100; >=9.0.40, <=9.0.108; >=10.1.0-M1, <=10.1.44; >=11.0.0-M1, <=11.0.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 27. 10. 2025.

Apache Tomcat - remote code execution (CVE-2025-55752)
CVSS 7.5 (High)

Using a specially crafted URL request, an authenticated remote attacker can, under certain conditions, bypass security restrictions including the protection of /WEB-INF/ and /META-INF/ and, if PUT requests are enabled (usually restricted), upload a malicious file and execute code. The vulnerability is a regression of the fix for a previous bug (no. 60013) and leads to URL normalization before its decoding [2].

The vulnerability is present in product:

  • Apache Tomcat; >=8.5.60, <=8.5.100; >=9.0.0.M11, <=9.0.108; >=10.1.0-M1, <=10.1.44; >=11.0.0-M1, <=11.0.10;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 27. 10. 2025.

Apache Tomcat - DoS (CVE-2025-61795)
CVSS 5.3 (Medium)

An authenticated remote attacker can, under certain conditions, carry out a DoS attack [3].

The vulnerability is present in product:

  • Apache Tomcat; >=8.5.0, <=8.5.100; >=9.0.0.M1, <=9.0.109; >=10.1.0-M1, <=10.1.46; >=11.0.0-M1, <=11.0.11;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 27. 10. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 29. 10. 2025.

CESNET, z.s.p.o. Logo