Apache Tomcat: Security constraint bypass for CGI scripts
Priority MEDIUM 44CWE-178Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 13 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03143 87th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat-catalina (Maven): 9.0.105, 10.1.41, 11.0.7org.apache.tomcat.embed:tomcat-embed-core (Maven): 9.0.105, 10.1.41, 11.0.7Red Hat: 11 advisoriesRed Hat: 13 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 11.0.0-M1 – 11.0.6; 10.1.0-M1 – 10.1.40; 9.0.0.M1 – 9.0.104; 8.5.0 – 8.5.100 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 9.0.0.M1 to before 9.0.105 | 9.0.105 | Patch available | GHSA-h2fw-rfh5-95r3 |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 10.1.0-M1 to before 10.1.41 | 10.1.41 | Patch available | GHSA-h2fw-rfh5-95r3 |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 11.0.0-M1 to before 11.0.7 | 11.0.7 | Patch available | GHSA-h2fw-rfh5-95r3 |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0.M1 to before 9.0.105 | 9.0.105 | Patch available | GHSA-h2fw-rfh5-95r3 |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 10.1.0-M1 to before 10.1.41 | 10.1.41 | Patch available | GHSA-h2fw-rfh5-95r3 |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 11.0.0-M1 to before 11.0.7 | 11.0.7 | Patch available | GHSA-h2fw-rfh5-95r3 |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 8.5.0 – 8.5.100 | — | No fix listed | GHSA-h2fw-rfh5-95r3 |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.5.0 – 8.5.100 | — | No fix listed | GHSA-h2fw-rfh5-95r3 |
- Apache Tomcat VendorApache Affected 11.0.0-M1 – 11.0.6; 10.1.0-M1 – 10.1.40; 9.0.0.M1 – 9.0.104; 8.5.0 – 8.5.100 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.105 Fixed in 9.0.105 Patch available GHSA-h2fw-rfh5-95r3
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.41 Fixed in 10.1.41 Patch available GHSA-h2fw-rfh5-95r3
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 11.0.0-M1 to before 11.0.7 Fixed in 11.0.7 Patch available GHSA-h2fw-rfh5-95r3
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.105 Fixed in 9.0.105 Patch available GHSA-h2fw-rfh5-95r3
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.41 Fixed in 10.1.41 Patch available GHSA-h2fw-rfh5-95r3
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 11.0.0-M1 to before 11.0.7 Fixed in 11.0.7 Patch available GHSA-h2fw-rfh5-95r3
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.5.0 – 8.5.100 Fixed in — No fix listed GHSA-h2fw-rfh5-95r3
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.0 – 8.5.100 Fixed in — No fix listed GHSA-h2fw-rfh5-95r3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 9.0.0 to before 9.0.105; 10.1.0 to before 10.1.41; 11.0.0 to before 11.0.7 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.0.105; 10.1.0 to before 10.1.41; 11.0.0 to before 11.0.7 Vulnerable ·Apache
Remediation
- Fix · GHSA-h2fw-rfh5-95r3 org.apache.tomcat:tomcat-catalina (Maven) Fixed in 9.0.105 Advisory →
- Fix · GHSA-h2fw-rfh5-95r3 org.apache.tomcat:tomcat-catalina (Maven) Fixed in 10.1.41 Advisory →
- Fix · GHSA-h2fw-rfh5-95r3 org.apache.tomcat:tomcat-catalina (Maven) Fixed in 11.0.7 Advisory →
- Fix · GHSA-h2fw-rfh5-95r3 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.105 Advisory →
- Fix · GHSA-h2fw-rfh5-95r3 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.1.41 Advisory →
- Fix · GHSA-h2fw-rfh5-95r3 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 11.0.7 Advisory →
Red Hat 11 advisories
- RHSA-2026:68677 Released 2026-09-17 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux AppStream (v. 8) tomcat-1:9.0.120-1.el8_10, tomcat-admin-webapps-1:9.0.120-1.el8_10, tomcat-docs-webapp-1:9.0.120-1.el8_10 +5
- RHSA-2026:68659 Released 2026-09-17 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) tomcat-1:9.0.120-1.el9_6, tomcat-admin-webapps-1:9.0.120-1.el9_6, tomcat-docs-webapp-1:9.0.120-1.el9_6 +5
- RHSA-2026:68678 Released 2026-09-17 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) tomcat-1:9.0.120-1.el9_2, tomcat-admin-webapps-1:9.0.120-1.el9_2, tomcat-docs-webapp-1:9.0.120-1.el9_2 +5
Show 8 more Red Hat advisories
- RHSA-2026:68679 Released 2026-09-17 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) tomcat-1:9.0.120-1.el9_4, tomcat-admin-webapps-1:9.0.120-1.el9_4, tomcat-docs-webapp-1:9.0.120-1.el9_4 +5
- RHSA-2026:68680 Released 2026-09-17 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) tomcat-1:9.0.120-1.el8_8, tomcat-admin-webapps-1:9.0.120-1.el8_8, tomcat-docs-webapp-1:9.0.120-1.el8_8 +5
- Red Hat Enterprise Linux AppStream TUS (v.8.8) tomcat-1:9.0.120-1.el8_8, tomcat-admin-webapps-1:9.0.120-1.el8_8, tomcat-docs-webapp-1:9.0.120-1.el8_8 +5
- RHSA-2026:67163 Released 2026-09-14 · Red Hat rating Importanttomcat9 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) tomcat9-1:9.0.120-1.el10_0, tomcat9-admin-webapps-1:9.0.120-1.el10_0, tomcat9-docs-webapp-1:9.0.120-1.el10_0 +5
- RHSA-2026:18916 Released 2026-05-19 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux AppStream (v. 9) tomcat-1:9.0.110-2.el9_8, tomcat-admin-webapps-1:9.0.110-2.el9_8, tomcat-docs-webapp-1:9.0.110-2.el9_8 +5
- RHSA-2026:18537 Released 2026-05-19 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux AppStream (v. 10) tomcat-1:10.1.49-1.el10, tomcat-admin-webapps-1:10.1.49-1.el10, tomcat-docs-webapp-1:10.1.49-1.el10 +5
- RHSA-2026:18536 Released 2026-05-19 · Red Hat rating Importanttomcat9 security update
- Red Hat Enterprise Linux AppStream (v. 10) tomcat9-1:9.0.110-2.el10_2, tomcat9-admin-webapps-1:9.0.110-2.el10_2, tomcat9-docs-webapp-1:9.0.110-2.el10_2 +5
- RHSA-2026:2740 Released 2026-02-16 · Red Hat rating ModerateRed Hat JBoss Web Server 6.2.0 security release
- Red Hat JBoss Web Server 6.2 on RHEL 10 jws6-tomcat-10.1.49-7.redhat_00006.1.el10jws, jws6-tomcat-admin-webapps-10.1.49-7.redhat_00006.1.el10jws, jws6-tomcat-docs-webapp-10.1.49-7.redhat_00006.1.el10jws +7
- Red Hat JBoss Web Server 6.2 on RHEL 8 jws6-tomcat-10.1.49-7.redhat_00006.1.el8jws, jws6-tomcat-admin-webapps-10.1.49-7.redhat_00006.1.el8jws, jws6-tomcat-docs-webapp-10.1.49-7.redhat_00006.1.el8jws +7
- Red Hat JBoss Web Server 6.2 on RHEL 9 jws6-tomcat-10.1.49-7.redhat_00006.1.el9jws, jws6-tomcat-admin-webapps-10.1.49-7.redhat_00006.1.el9jws, jws6-tomcat-docs-webapp-10.1.49-7.redhat_00006.1.el9jws +7
- RHSA-2026:2741 Released 2026-02-16 · Red Hat rating ModerateRed Hat JBoss Web Server 6.2.0 security release
- Red Hat JBoss Web Server 6.2.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Web Server 5 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:18536, RHSA-2026:18537 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:68677 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:18916 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:68680 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:68678 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:68679 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:67163 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:68659 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:68680 |
| Red Hat JBoss Web Server 6.2 on RHEL 10 | Fixed | RHSA-2026:2740 |
| Red Hat JBoss Web Server 6.2 on RHEL 8 | Fixed | RHSA-2026:2740 |
| Red Hat JBoss Web Server 6.2 on RHEL 9 | Fixed | RHSA-2026:2740 |
| Red Hat JBoss Web Server 6.2.0 | Fixed | RHSA-2026:2741 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-46701
- 2026-10-03 Alias added: GHSA-h2fw-rfh5-95r3
References
Advisory 3
Other 11
- https://github.com/apache/tomcat/commit/0f01966eb60015d975525019e12a087f05ebf01a
- https://github.com/apache/tomcat/commit/238d2aa54b99f91d1111467e2237d2244c64e558
- https://github.com/apache/tomcat/commit/2c6800111e7d8d8d5403c07978ea9bff3db5a5a5
- https://github.com/apache/tomcat/commit/8cb95ff03221067c511b3fa66d4f745bc4b0a605
- https://github.com/apache/tomcat/commit/8df00018a252baa9497615d6420fb6c10466fa74
- https://github.com/apache/tomcat/commit/fab7247d2f0e3a29d5daef565f829f383e10e5e2
- https://github.com/apache/tomcat
- https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.41
- https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.7
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.105
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2025-46701 · CVE Program
- CVE-2025-46701 · NVD
- FIRST EPSS
- GHSA-h2fw-rfh5-95r3 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-46701 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences