CVE-2025-49125 Apache Tomcat: Security constraint bypass for pre/post-resources

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by th...

CVE-2025-49125

CVE-2025-49125 describes an Authentication Bypass via an Alternate Path or Channel in Apache Tomcat. Affected: Tomcat 11.0.0-M1–11.0.7, 10.1.0-M1–10.1.41, 9.0.0.M1–9.0.105; EOL versions (e.g., 8.5.x) may also be affected. Upstream fix advised: upgrade to Tomcat 11.0.8, 10.1.42 or 9.0.106. The CVS...

Mageia: Security Advisory (MGASA-2025-0177)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-24660 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.24.4 GeoServer versions prior to 2.25.2 Description: The issue allows for Service Side Request Forgery SSRF via the Demo request endpoint if the Proxy Base URL has not been set. This can be used by an...

Fixed in Apache Tomcat 10.1.42

Moderate: Session fixation possible via rewrite valve CVE-2025-55668 If the rewrite valve was enabled for a web application, an attacker was able to craft a URL that, if a victim clicked on it, would cause the victim's interaction with that resource to occur in the context of the attacker's...

MGASA-2025-0177 Updated tomcat packages fix security vulnerability

Security constraint bypass for CGI scripts. CVE-2025-46701...

Apache Tomcat 9.0.0-M1 < 9.0.105 CGI Security Constraint Bypass

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.105, 10.1.0-M1 prior to 10.1.41 or 11.0.0-M1 prior to 11.0.7. It is, therefore, affected by a CGI security sonstraint bypass. Note that the scanner has not attempted to exploit these issues but has instead relied...

Apache Tomcat CGI Security Constraint Bypass Vulnerability (May 2025) - Linux

Apache Tomcat is prone to a CGI security constraint bypass vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tomcat - CGI security constraint bypass

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...

DEBIAN-CVE-2025-46701

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...

CVE-2025-46701

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...

CVE-2025-46701 Apache Tomcat: Security constraint bypass for CGI scripts

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...

CVE-2025-46701

CVE-2025-46701 affects Apache Tomcat GCI servlet; security constraint bypass via pathInfo handling. Public advisories confirm affected branches: Tomcat 11.x up to 11.0.6, 10.x up to 10.1.40, 9.x up to 9.0.104. Remediation versions listed: 11.0.7, 10.1.41, 9.0.105. Debian/DSA and Amazon Linux advi...

CVE-2025-46701 Apache Tomcat: Security constraint bypass for CGI scripts

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...

Apache Tomcat 10.1.0.M1 < 10.1.41

The version of Tomcat installed on the remote host is prior to 10.1.41. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.41security-10 advisory. - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constrain...

Apache Tomcat 9.0.0.M1 < 9.0.105

The version of Tomcat installed on the remote host is prior to 9.0.105. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.105security-9 advisory. - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint...

CVE-2024-29231

Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors...

CVE-2022-45956

Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism...

Fixed in Apache Tomcat 10.1.41

Low: CGI security constraint bypass CVE-2025-46701 When running on a case insensitive file system with security constraints configured for the pathInfo component of a URL that mapped to the CGI servlet, it was possible to bypass those security constraints with a specially crafted URL. This was...

Apache Tomcat Input Validation Error Vulnerability (CNVD-2025-10031)

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server . Used to implement the Servlet and JavaServer Page JSP support. An input validation error vulnerability exists in Apache Tomcat that stems from improperly neutralizing escape, meta, or control...