tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update

Red Hat JBoss Web Server 6.2.5 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - リライトルールバイパス 発見者: gregk4sec https://github.com/gregk4sec/cve 発見日: 2025-02-28 影響を受けるベンダー: Apache 影響を受ける製品: Tomcat 9.0.x / 10.1.x / 11.0.x 深刻度: Critical / High CWE: CWE-116 ステータス: 審査中 / 修正済み / 公開 ✅ / 非公開 概要...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update

Red Hat JBoss Web Server 6.2.5 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

Rocky Linux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1768821437)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768821437 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788353293)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788353293 advisory. - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constrain...

Rocky Linux 10.0 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14179)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514179 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

AlmaLinux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1768821437)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768821437 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rul...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788273808)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788273808 advisory. - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constrain...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1750785145)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1750785145 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774859936)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774859936 advisory. - Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security...

Rocky Linux 10.0 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14178)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514178 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2025:1764716872)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764716872 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14181)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514181 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14177)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514177 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 10.2 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_18537)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202618537 advisory. tomcat: Apache Tomcat: Security constraint bypass for CGI scripts CVE-2025-46701 org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session...

AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1775646020)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1775646020 advisory. - Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly...