Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Improper Neutralization Of Escape, Meta, Or Control Sequences

🗓️ 02 May 2025 13:47:29Reported by Veracode Vulnerability DatabaseType 
veracode
 veracode🔗 sca.analysiscenter.veracode.com👁 12 Views

Tomcat has improper neutralization of escape sequences enabling crafted requests bypass rules.

Related
Detection
Refs
ReporterTitlePublishedViews
Family
IBM Security Bulletins		Security Bulletin: IBM Integration Bus for z/OS is vulnerable to Incomplete Cleanup and Improper Encoding or Escaping of Output due to Apache Tomcat (CVE-2025-31650 & CVE-2025-31651)
21 May 202505:09
–ibm
IBM Security Bulletins		Security Bulletin: Vulnerabilities in tomcat affects IBM Netezza Appliance
3 Jun 202610:39
–ibm
IBM Security Bulletins		Security Bulletin: due to the use of Apache Tomcat, IBM webMethods developer portal is affected by Multiple Vulnerabilities
30 Sep 202510:47
–ibm
IBM Security Bulletins		Security Bulletin: Due to the use of Apache Tomcat, IBM ApplinX is vulnerable to an Improper Encoding or Escaping of Output vulnerability (CVE-2025-31651) and an Improper Input Validation vulnerability (CVE-2025-31651).
16 May 202508:06
–ibm
IBM Security Bulletins		Security Bulletin: Vulnerabilities in Apache Tomcat and form-data might affect IBM Storage Defender Copy Data Management.
26 Sep 202518:32
–ibm
IBM Security Bulletins		Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities
7 Jul 202517:00
–ibm
IBM Security Bulletins		Security Bulletin: Vulnerability in Apache Tomcat affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
25 Sep 202511:51
–ibm
IBM Security Bulletins		Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities
6 Mar 202616:04
–ibm
IBM Security Bulletins		Security Bulletin: Vulnerabilities in Apache Tomcat Server (CVE-2025-52434, CVE-2025-48989, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668, CVE-2025-49125, CVE-2025-48988, CVE-2025-46701, CVE-2025-31651, CVE-2025-31650) affect Power HMC.
20 Nov 202506:10
–ibm
IBM Security Bulletins		Security Bulletin: Vulnerabilities in Linux Kernel, MongoDB and Tomcat affect IBM Spectrum Protect Plus
1 Apr 202616:36
–ibm
Rows per page
Vulners
Node
OR
apachetomcat-catalinaRange9.0.0.M1–9.0.102java
apachetomcat-catalinaRange10.1.0-M1–10.1.39java
apachetomcat-catalinaRange11.0.0-M1–11.0.5java
apachetomcat-catalinaMatch9.0.100java
apachetomcat-catalinaMatch9.0.76java
apachetomcat-catalinaMatch9.0.78java
apachetomcat-catalinaMatch9.0.79java
apachetomcat-catalinaMatch9.0.80java
apachetomcat-catalinaMatch9.0.81java
apachetomcat-catalinaMatch9.0.82java
apachetomcat-catalinaMatch9.0.83java
apachetomcat-catalinaMatch9.0.84java
apachetomcat-catalinaMatch9.0.85java
apachetomcat-catalinaMatch9.0.86java
apachetomcat-catalinaMatch9.0.87java
apachetomcat-catalinaMatch9.0.88java
apachetomcat-catalinaMatch9.0.89java
apachetomcat-catalinaMatch9.0.90java
apachetomcat-catalinaMatch9.0.91java
apachetomcat-catalinaMatch9.0.93java
apachetomcat-catalinaMatch9.0.94java
apachetomcat-catalinaMatch9.0.95java
apachetomcat-catalinaMatch9.0.96java
apachetomcat-catalinaMatch9.0.97java
apachetomcat-catalinaMatch9.0.98java
apachetomcat-catalinaMatch9.0.99java
apachetomcat-catalinaMatch10.1.10java
apachetomcat-catalinaMatch10.1.11java
apachetomcat-catalinaMatch10.1.12java
apachetomcat-catalinaMatch10.1.13java
apachetomcat-catalinaMatch10.1.14java
apachetomcat-catalinaMatch10.1.15java
apachetomcat-catalinaMatch10.1.16java
apachetomcat-catalinaMatch10.1.17java
apachetomcat-catalinaMatch10.1.18java
apachetomcat-catalinaMatch10.1.19java
apachetomcat-catalinaMatch10.1.20java
apachetomcat-catalinaMatch10.1.23java
apachetomcat-catalinaMatch10.1.24java
apachetomcat-catalinaMatch10.1.25java
apachetomcat-catalinaMatch10.1.26java
apachetomcat-catalinaMatch10.1.28java
apachetomcat-catalinaMatch10.1.29java
apachetomcat-catalinaMatch10.1.30java
apachetomcat-catalinaMatch10.1.31java
apachetomcat-catalinaMatch10.1.33java
apachetomcat-catalinaMatch10.1.34java
apachetomcat-catalinaMatch10.1.35java
apachetomcat-catalinaMatch10.1.36java
apachetomcat-catalinaMatch11.0.0java
apachetomcat-catalinaMatch11.0.0-m10java
apachetomcat-catalinaMatch11.0.0-m11java
apachetomcat-catalinaMatch11.0.0-m12java
apachetomcat-catalinaMatch11.0.0-m13java
apachetomcat-catalinaMatch11.0.0-m14java
apachetomcat-catalinaMatch11.0.0-m15java
apachetomcat-catalinaMatch11.0.0-m16java
apachetomcat-catalinaMatch11.0.0-m17java
apachetomcat-catalinaMatch11.0.0-m18java
apachetomcat-catalinaMatch11.0.0-m19java
apachetomcat-catalinaMatch11.0.0-m20java
apachetomcat-catalinaMatch11.0.0-m21java
apachetomcat-catalinaMatch11.0.0-m22java
apachetomcat-catalinaMatch11.0.0-m24java
apachetomcat-catalinaMatch11.0.0-m25java
apachetomcat-catalinaMatch11.0.0-m26java
apachetomcat-catalinaMatch11.0.0-m3java
apachetomcat-catalinaMatch11.0.0-m4java
apachetomcat-catalinaMatch11.0.0-m5java
apachetomcat-catalinaMatch11.0.0-m6java
apachetomcat-catalinaMatch11.0.0-m7java
apachetomcat-catalinaMatch11.0.0-m9java
apachetomcat-catalinaMatch11.0.1java
apachetomcat-catalinaMatch11.0.2java
apachetomcat-catalinaMatch11.0.3java
apachetomcat-catalinaMatch11.0.4java
apachetomcat-catalinaMatch8.5.0java
apachetomcat-catalinaMatch8.5.100java
apachetomcat-catalinaMatch8.5.11java
apachetomcat-catalinaMatch8.5.12java
apachetomcat-catalinaMatch8.5.13java
apachetomcat-catalinaMatch8.5.14java
apachetomcat-catalinaMatch8.5.15java
apachetomcat-catalinaMatch8.5.16java
apachetomcat-catalinaMatch8.5.19java
apachetomcat-catalinaMatch8.5.2java
apachetomcat-catalinaMatch8.5.20java
apachetomcat-catalinaMatch8.5.21java
apachetomcat-catalinaMatch8.5.23java
apachetomcat-catalinaMatch8.5.24java
apachetomcat-catalinaMatch8.5.27java
apachetomcat-catalinaMatch8.5.28java
apachetomcat-catalinaMatch8.5.29java
apachetomcat-catalinaMatch8.5.3java
apachetomcat-catalinaMatch8.5.30java
apachetomcat-catalinaMatch8.5.31java
apachetomcat-catalinaMatch8.5.32java
apachetomcat-catalinaMatch8.5.33java
apachetomcat-catalinaMatch8.5.34java
apachetomcat-catalinaMatch8.5.35java
apachetomcat-catalinaMatch8.5.37java
apachetomcat-catalinaMatch8.5.38java
apachetomcat-catalinaMatch8.5.39java
apachetomcat-catalinaMatch8.5.4java
apachetomcat-catalinaMatch8.5.40java
apachetomcat-catalinaMatch8.5.41java
apachetomcat-catalinaMatch8.5.42java
apachetomcat-catalinaMatch8.5.43java
apachetomcat-catalinaMatch8.5.45java
apachetomcat-catalinaMatch8.5.46java
apachetomcat-catalinaMatch8.5.47java
apachetomcat-catalinaMatch8.5.49java
apachetomcat-catalinaMatch8.5.5java
apachetomcat-catalinaMatch8.5.50java
apachetomcat-catalinaMatch8.5.51java
apachetomcat-catalinaMatch8.5.53java
apachetomcat-catalinaMatch8.5.54java
apachetomcat-catalinaMatch8.5.55java
apachetomcat-catalinaMatch8.5.56java
apachetomcat-catalinaMatch8.5.57java
apachetomcat-catalinaMatch8.5.58java
apachetomcat-catalinaMatch8.5.59java
apachetomcat-catalinaMatch8.5.6java
apachetomcat-catalinaMatch8.5.60java
apachetomcat-catalinaMatch8.5.61java
apachetomcat-catalinaMatch8.5.63java
apachetomcat-catalinaMatch8.5.64java
apachetomcat-catalinaMatch8.5.65java
apachetomcat-catalinaMatch8.5.66java
apachetomcat-catalinaMatch8.5.68java
apachetomcat-catalinaMatch8.5.69java
apachetomcat-catalinaMatch8.5.70java
apachetomcat-catalinaMatch8.5.71java
apachetomcat-catalinaMatch8.5.72java
apachetomcat-catalinaMatch8.5.73java
apachetomcat-catalinaMatch8.5.75java
apachetomcat-catalinaMatch8.5.76java
apachetomcat-catalinaMatch8.5.77java
apachetomcat-catalinaMatch8.5.78java
apachetomcat-catalinaMatch8.5.79java
apachetomcat-catalinaMatch8.5.8java
apachetomcat-catalinaMatch8.5.81java
apachetomcat-catalinaMatch8.5.82java
apachetomcat-catalinaMatch8.5.83java
apachetomcat-catalinaMatch8.5.84java
apachetomcat-catalinaMatch8.5.85java
apachetomcat-catalinaMatch8.5.86java
apachetomcat-catalinaMatch8.5.87java
apachetomcat-catalinaMatch8.5.88java
apachetomcat-catalinaMatch8.5.89java
apachetomcat-catalinaMatch8.5.9java
apachetomcat-catalinaMatch8.5.90java
apachetomcat-catalinaMatch8.5.91java
apachetomcat-catalinaMatch8.5.92java
apachetomcat-catalinaMatch8.5.93java
apachetomcat-catalinaMatch8.5.94java
apachetomcat-catalinaMatch8.5.95java
apachetomcat-catalinaMatch8.5.96java
apachetomcat-catalinaMatch8.5.97java
apachetomcat-catalinaMatch8.5.98java
apachetomcat-catalinaMatch8.5.99java
apachetomcat-embed-coreRange9.0.0.M1–9.0.102java
apachetomcat-embed-coreRange11.0.0-M1–11.0.5java
apachetomcat-embed-coreRange10.1.10–10.1.39java
apachetomcat-embed-coreMatch9.0.100java
apachetomcat-embed-coreMatch9.0.76java
apachetomcat-embed-coreMatch9.0.78java
apachetomcat-embed-coreMatch9.0.79java
apachetomcat-embed-coreMatch9.0.80java
apachetomcat-embed-coreMatch9.0.81java
apachetomcat-embed-coreMatch9.0.82java
apachetomcat-embed-coreMatch9.0.83java
apachetomcat-embed-coreMatch9.0.84java
apachetomcat-embed-coreMatch9.0.85java
apachetomcat-embed-coreMatch9.0.86java
apachetomcat-embed-coreMatch9.0.87java
apachetomcat-embed-coreMatch9.0.88java
apachetomcat-embed-coreMatch9.0.89java
apachetomcat-embed-coreMatch9.0.90java
apachetomcat-embed-coreMatch9.0.91java
apachetomcat-embed-coreMatch9.0.93java
apachetomcat-embed-coreMatch9.0.94java
apachetomcat-embed-coreMatch9.0.95java
apachetomcat-embed-coreMatch9.0.96java
apachetomcat-embed-coreMatch9.0.97java
apachetomcat-embed-coreMatch9.0.98java
apachetomcat-embed-coreMatch9.0.99java
apachetomcat-embed-coreMatch10.1.10java
apachetomcat-embed-coreMatch10.1.11java
apachetomcat-embed-coreMatch10.1.12java
apachetomcat-embed-coreMatch10.1.13java
apachetomcat-embed-coreMatch10.1.14java
apachetomcat-embed-coreMatch10.1.15java
apachetomcat-embed-coreMatch10.1.16java
apachetomcat-embed-coreMatch10.1.17java
apachetomcat-embed-coreMatch10.1.18java
apachetomcat-embed-coreMatch10.1.19java
apachetomcat-embed-coreMatch10.1.20java
apachetomcat-embed-coreMatch10.1.23java
apachetomcat-embed-coreMatch10.1.24java
apachetomcat-embed-coreMatch10.1.25java
apachetomcat-embed-coreMatch10.1.26java
apachetomcat-embed-coreMatch10.1.28java
apachetomcat-embed-coreMatch10.1.29java
apachetomcat-embed-coreMatch10.1.30java
apachetomcat-embed-coreMatch10.1.31java
apachetomcat-embed-coreMatch10.1.33java
apachetomcat-embed-coreMatch10.1.34java
apachetomcat-embed-coreMatch10.1.35java
apachetomcat-embed-coreMatch10.1.36java
apachetomcat-embed-coreMatch11.0.0java
apachetomcat-embed-coreMatch11.0.0-m10java
apachetomcat-embed-coreMatch11.0.0-m11java
apachetomcat-embed-coreMatch11.0.0-m12java
apachetomcat-embed-coreMatch11.0.0-m13java
apachetomcat-embed-coreMatch11.0.0-m14java
apachetomcat-embed-coreMatch11.0.0-m15java
apachetomcat-embed-coreMatch11.0.0-m16java
apachetomcat-embed-coreMatch11.0.0-m17java
apachetomcat-embed-coreMatch11.0.0-m18java
apachetomcat-embed-coreMatch11.0.0-m19java
apachetomcat-embed-coreMatch11.0.0-m20java
apachetomcat-embed-coreMatch11.0.0-m21java
apachetomcat-embed-coreMatch11.0.0-m22java
apachetomcat-embed-coreMatch11.0.0-m24java
apachetomcat-embed-coreMatch11.0.0-m25java
apachetomcat-embed-coreMatch11.0.0-m26java
apachetomcat-embed-coreMatch11.0.0-m3java
apachetomcat-embed-coreMatch11.0.0-m4java
apachetomcat-embed-coreMatch11.0.0-m5java
apachetomcat-embed-coreMatch11.0.0-m6java
apachetomcat-embed-coreMatch11.0.0-m7java
apachetomcat-embed-coreMatch11.0.0-m9java
apachetomcat-embed-coreMatch11.0.1java
apachetomcat-embed-coreMatch11.0.2java
apachetomcat-embed-coreMatch11.0.3java
apachetomcat-embed-coreMatch11.0.4java
apachetomcat-embed-coreMatch8.5.0java
apachetomcat-embed-coreMatch8.5.100java
apachetomcat-embed-coreMatch8.5.11java
apachetomcat-embed-coreMatch8.5.12java
apachetomcat-embed-coreMatch8.5.13java
apachetomcat-embed-coreMatch8.5.14java
apachetomcat-embed-coreMatch8.5.15java
apachetomcat-embed-coreMatch8.5.16java
apachetomcat-embed-coreMatch8.5.19java
apachetomcat-embed-coreMatch8.5.2java
apachetomcat-embed-coreMatch8.5.20java
apachetomcat-embed-coreMatch8.5.21java
apachetomcat-embed-coreMatch8.5.23java
apachetomcat-embed-coreMatch8.5.24java
apachetomcat-embed-coreMatch8.5.27java
apachetomcat-embed-coreMatch8.5.28java
apachetomcat-embed-coreMatch8.5.29java
apachetomcat-embed-coreMatch8.5.3java
apachetomcat-embed-coreMatch8.5.30java
apachetomcat-embed-coreMatch8.5.31java
apachetomcat-embed-coreMatch8.5.32java
apachetomcat-embed-coreMatch8.5.33java
apachetomcat-embed-coreMatch8.5.34java
apachetomcat-embed-coreMatch8.5.35java
apachetomcat-embed-coreMatch8.5.37java
apachetomcat-embed-coreMatch8.5.38java
apachetomcat-embed-coreMatch8.5.39java
apachetomcat-embed-coreMatch8.5.4java
apachetomcat-embed-coreMatch8.5.40java
apachetomcat-embed-coreMatch8.5.41java
apachetomcat-embed-coreMatch8.5.42java
apachetomcat-embed-coreMatch8.5.43java
apachetomcat-embed-coreMatch8.5.45java
apachetomcat-embed-coreMatch8.5.46java
apachetomcat-embed-coreMatch8.5.47java
apachetomcat-embed-coreMatch8.5.49java
apachetomcat-embed-coreMatch8.5.5java
apachetomcat-embed-coreMatch8.5.50java
apachetomcat-embed-coreMatch8.5.51java
apachetomcat-embed-coreMatch8.5.53java
apachetomcat-embed-coreMatch8.5.54java
apachetomcat-embed-coreMatch8.5.55java
apachetomcat-embed-coreMatch8.5.56java
apachetomcat-embed-coreMatch8.5.57java
apachetomcat-embed-coreMatch8.5.58java
apachetomcat-embed-coreMatch8.5.59java
apachetomcat-embed-coreMatch8.5.6java
apachetomcat-embed-coreMatch8.5.60java
apachetomcat-embed-coreMatch8.5.61java
apachetomcat-embed-coreMatch8.5.63java
apachetomcat-embed-coreMatch8.5.64java
apachetomcat-embed-coreMatch8.5.65java
apachetomcat-embed-coreMatch8.5.66java
apachetomcat-embed-coreMatch8.5.68java
apachetomcat-embed-coreMatch8.5.69java
apachetomcat-embed-coreMatch8.5.70java
apachetomcat-embed-coreMatch8.5.71java
apachetomcat-embed-coreMatch8.5.72java
apachetomcat-embed-coreMatch8.5.73java
apachetomcat-embed-coreMatch8.5.75java
apachetomcat-embed-coreMatch8.5.76java
apachetomcat-embed-coreMatch8.5.77java
apachetomcat-embed-coreMatch8.5.78java
apachetomcat-embed-coreMatch8.5.79java
apachetomcat-embed-coreMatch8.5.8java
apachetomcat-embed-coreMatch8.5.81java
apachetomcat-embed-coreMatch8.5.82java
apachetomcat-embed-coreMatch8.5.83java
apachetomcat-embed-coreMatch8.5.84java
apachetomcat-embed-coreMatch8.5.85java
apachetomcat-embed-coreMatch8.5.86java
apachetomcat-embed-coreMatch8.5.87java
apachetomcat-embed-coreMatch8.5.88java
apachetomcat-embed-coreMatch8.5.89java
apachetomcat-embed-coreMatch8.5.9java
apachetomcat-embed-coreMatch8.5.90java
apachetomcat-embed-coreMatch8.5.91java
apachetomcat-embed-coreMatch8.5.92java
apachetomcat-embed-coreMatch8.5.93java
apachetomcat-embed-coreMatch8.5.94java
apachetomcat-embed-coreMatch8.5.95java
apachetomcat-embed-coreMatch8.5.96java
apachetomcat-embed-coreMatch8.5.97java
apachetomcat-embed-coreMatch8.5.98java
apachetomcat-embed-coreMatch8.5.99java

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
22 Jun 2026 09:06Current
7.1High risk
Vulners AI Score7.1
CVSS 3.19.8
EPSS0.04273
SSVC
Tomcat vulnerabilityimproper neutralizationescape sequencescrafted requestsbypass rules
12