Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.104, 10.1.0-M1 prior to 10.1.40 or 11.0.0-M1 prior to 11.0.6. It is, therefore, affected by multiple vulnerabilities :

 - A denial of service via invalid HTTP priority header. (CVE-2025-31650)

 - A rewrite rule bypass. (CVE-2025-31651)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1537-1 advisory.

    Update to Tomcat 10.1.40

    - CVE-2025-31650: invalid priority field values should be ignored (bsc#1242008)
    - CVE-2025-31651: Better handling of URLs with literal ';' and '?' (bsc#1242009)

    Full changelog:

    https://tomcat.apache.org/tomcat-10.1-doc/changelog.html

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-965 advisory.

    Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP     priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A     large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

    This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from     11.0.0-M2 through 11.0.5. (CVE-2025-31650)

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. (CVE-2025-31651)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-964 advisory.

    Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP     priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A     large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

    This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from     11.0.0-M2 through 11.0.5. (CVE-2025-31650)

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. (CVE-2025-31651)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1521-1 advisory.

    Update to Tomcat 9.0.104

    - CVE-2025-31650: invalid priority field values should be ignored (bsc#1242008)
    - CVE-2025-31651: Better handling of URLs with literal ';' and '?' (bsc#1242009)

    Full changelog:

    https://tomcat.apache.org/tomcat-9.0-doc/changelog.htm

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.104. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.104_security-9 advisory.

  - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP     priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A     large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This     issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2     through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the     issue. (CVE-2025-31650)

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which     fixes the issue. (CVE-2025-31651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.40. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.40_security-10 advisory.

  - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP     priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A     large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This     issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2     through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the     issue. (CVE-2025-31650)

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which     fixes the issue. (CVE-2025-31651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.6_security-11 advisory.

  - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP     priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A     large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This     issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2     through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the     issue. (CVE-2025-31650)

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset     of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some     rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could     be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through     10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which     fixes the issue. (CVE-2025-31651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114789	Apache Tomcat 9.0.0-M1 < 9.0.104 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
114788	Apache Tomcat 10.1.0-M1 < 10.1.40 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
114787	Apache Tomcat 11.0.0-M1 < 11.0.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
235937	Photon OS 4.0: Apache PHSA-2025-4.0-0798	Nessus	PhotonOS Local Security Checks	high
235925	SUSE SLES15 / openSUSE 15 Security Update : tomcat10 (SUSE-SU-2025:1537-1)	Nessus	SuSE Local Security Checks	high
235893	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-965)	Nessus	Amazon Linux Local Security Checks	high
235881	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-964)	Nessus	Amazon Linux Local Security Checks	high
235672	SUSE SLES15 / openSUSE 15 Security Update : tomcat (SUSE-SU-2025:1521-1)	Nessus	SuSE Local Security Checks	high
235654	Photon OS 5.0: Apache PHSA-2025-5.0-0519	Nessus	PhotonOS Local Security Checks	high
235034	Apache Tomcat 9.0.0.M1 < 9.0.104 multiple vulnerabilities	Nessus	Web Servers	high
235033	Apache Tomcat 10.1.0.M1 < 10.1.40 multiple vulnerabilities	Nessus	Web Servers	high
235032	Apache Tomcat 11.0.0.M1 < 11.0.6 multiple vulnerabilities	Nessus	Web Servers	high

Detections

Analytics

CVE-2025-31651

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high