org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve

🗓️ 15 Apr 2026 17:31:38Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Apache Tomcat rewrite valve can enable session fixation allowing attacker to hijack victim sessions.

Reporter	Title	Published	Views	Family All 94
IBM Security Bulletins	Security Bulletin: Common Vulnerabilities Addressed in Cloudera Data Platform Private Cloud Base with IBM 7.3.1	15 May 202615:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat Server (CVE-2025-52434, CVE-2025-48989, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668, CVE-2025-49125, CVE-2025-48988, CVE-2025-46701, CVE-2025-31651, CVE-2025-31650) affect Power HMC.	20 Nov 202506:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM webMethods BPM is affected by multiple vulnerabilities	12 Nov 202514:34	–	ibm
Tenable Nessus	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1065)	10 Jul 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-1093)	4 Aug 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2025-020 (ALASTOMCAT9-2025-020)	10 Jul 202500:00	–	nessus
Tenable Nessus	Debian dsa-6120 : libtomcat10-embed-java - security update	5 Feb 202600:00	–	nessus
Tenable Nessus	Debian dsa-6121 : libtomcat11-embed-java - security update	5 Feb 202600:00	–	nessus
Tenable Nessus	Oracle Linux 10 : tomcat9 (ELSA-2026-18536)	22 Jul 202600:00	–	nessus
Tenable Nessus	Oracle Linux 10 : tomcat (ELSA-2026-18537)	22 Jul 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	noarch	tomcat10	10.1.54-1.hum1	tomcat10-10.1.54-1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-55668
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6
github	www.github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21
github	www.github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95
lists	www.lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-55668
cve	www.cve.org/CVERecord

26 Jul 2026 17:02Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.5

EPSS0.00831

SSVC

apache tomcat session fixation rewrite valve attack vector session hijack crafted link web application vulnerability unix