cve-2025-31651

CVE-2025-36701 — Apache Tomcat - リライトルールバイパス 発見者: gregk4sec https://github.com/gregk4sec/cve 発見日: 2025-02-28 影響を受けるベンダー: Apache 影響を受ける製品: Tomcat 9.0.x / 10.1.x / 11.0.x 深刻度: Critical / High CWE: CWE-116 ステータス: 審査中 / 修正済み / 公開 ✅ / 非公開 概要...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

CVE-2026-24733

CVE-2026-24733 什么是 CVE-2026-24733？Apache Tomcat 在某些安全约束配置下错误地处理了 HTTP/0.9 风格的 HEAD 请求。 CVE-2026-24733 防御性验证器 一个轻量级、无依赖的 Python 安全验证器，用于检测 CVE-2026-24733 ，即 Apache Tomcat HTTP/0.9 HEAD 安全约束 绕过漏洞。 该项目专为以下人员设计： 蓝队 SOC 分析师 漏洞管理团队 获得授权的渗透测试人员 安全研究人员 CI/CD 安全检查 内部资产验证 仅限授权测试。 仅扫描您拥有或已获得明确测试许可的系统。 什么是...

cve-2026-43515-poc

CVE-2026-43515 — Apache Tomcat 安全约束绕过 可利用性判定： 确认可利用。针对受分割的 配置保护的资源的 POST 请求会完全绕过身份验证。所需 web.xml 配置在标准部署中不常见——详见分析。 目录 概述 受影响版本 根本原因 分析 仓库结构 依赖要求 使用方法 预期输出 参考链接 免责声明 概述 CVE-2026-43515 是 Apache Tomcat 安全约束评估逻辑中的一个漏洞。当一个 定义了多个 块，这些块共享相同的 URL 扩展名模式（例如 .html），但每个块声明了不同的 HTTP 方法时，Tomcat 仅对第一个 匹配集合中声明的...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update

Red Hat JBoss Web Server 6.2.5 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update

Red Hat JBoss Web Server 6.2.5 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1784625369)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784625369 advisory. - Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some...

Rocky Linux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1768821437)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768821437 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1784625369)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784625369 advisory. - Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14181)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514181 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 10.0 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14178)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514178 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14177)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514177 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 10.0 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14179)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514179 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 10.2 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_18537)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202618537 advisory. tomcat: Apache Tomcat: Security constraint bypass for CGI scripts CVE-2025-46701 org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788353293)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788353293 advisory. - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constrain...