CVE-2025-31651

🗓️ 28 Apr 2025 19:17:21Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 474 Views

Improper escape sequence vulnerability in Apache Tomcat may bypass security rewrite rules.

Reporter	Title	Published	Views	Family All 283
IBM Security Bulletins	Security Bulletin: IBM Integration Bus for z/OS is vulnerable to Incomplete Cleanup and Improper Encoding or Escaping of Output due to Apache Tomcat (CVE-2025-31650 & CVE-2025-31651)	21 May 202505:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in tomcat affects IBM Netezza Appliance	3 Jun 202610:39	–	ibm
IBM Security Bulletins	Security Bulletin: due to the use of Apache Tomcat, IBM webMethods developer portal is affected by Multiple Vulnerabilities	30 Sep 202510:47	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Apache Tomcat, IBM ApplinX is vulnerable to an Improper Encoding or Escaping of Output vulnerability (CVE-2025-31651) and an Improper Input Validation vulnerability (CVE-2025-31651).	16 May 202508:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat and form-data might affect IBM Storage Defender Copy Data Management.	26 Sep 202518:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	7 Jul 202517:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Sep 202511:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities	6 Mar 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat Server (CVE-2025-52434, CVE-2025-48989, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668, CVE-2025-49125, CVE-2025-48988, CVE-2025-46701, CVE-2025-31651, CVE-2025-31650) affect Power HMC.	20 Nov 202506:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Linux Kernel, MongoDB and Tomcat affect IBM Spectrum Protect Plus	1 Apr 202616:36	–	ibm

NVD

Vulners

Node

apache tomcatRange9.0.0–9.0.104

apache tomcatRange10.1.0–10.1.40

apache tomcatRange11.0.0–11.0.6

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "11.0.5",
        "status": "affected",
        "version": "11.0.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.1.39",
        "status": "affected",
        "version": "10.1.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.0.102",
        "status": "affected",
        "version": "9.0.0.M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.5.100",
        "status": "affected",
        "version": "8.5.0",
        "versionType": "semver"
      },
      {
        "lessThan": "8.5.0",
        "status": "unknown",
        "version": "8.0.0.RC1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.0.27",
        "status": "unknown",
        "version": "10.0.0-M1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/list.html
openwall	www.openwall.com/lists/oss-security/2025/04/28/3
lists	www.lists.debian.org/debian-lts-announce/2025/07/msg00009.html

03 Nov 2025 20:18Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8

EPSS0.00341

SSVC

CWE-116