Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

oracle CPUJul2025: Oracle Database Server

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02280-1 advisory.

    - CVE-2025-46701: Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).
    - CVE-2025-48988: Fixed limits the total number of parts in a multi-part request and limits the size of     the headers provided with each part (bsc#1244656).
    - CVE-2025-49125: Fixed expand checks for webAppMount (bsc#1244649).

    Other bugfixes:

    - Made permissions more secure (bsc#1242722)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02261-1 advisory.

    - Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).
    - Fixed limits the total number of parts in a multi-part request and       limits the size of the headers provided with each part (bsc#1244656).
    - Fixed expand checks for webAppMount (bsc#1244649).
    - Hardening permissions (bsc#1242722)

    Update to Tomcat 10.1.42:

      * Fixed CVEs:

        - CVE-2025-46701: refactor CGI servlet to access resources via           WebResources (bsc#1243815)
        - CVE-2025-48988: limits the total number of parts in a           multi-part request and limits the size of           the headers provided with each part (bsc#1244656)
        - CVE-2025-49125: Expand checks for webAppMount (bsc#1244649)

      * Catalina:

        - Add: Support for the java:module namespace which mirrors the           java:comp namespace.
        - Add: Support parsing of multiple path parameters separated by ; in a           single URL segment. Based on pull request #860 by Chenjp.
        - Add: Support for limiting the number of parameters in HTTP requests           through the new ParameterLimitValve. The valve allows configurable           URL-specific limits on the number of parameters.
        - Fix: 69699: Encode redirect URL used by the rewrite valve with the           session id if appropriate, and handle cross context with different           session configuration when using rewrite.
        - Add: #863: Support for comments at the end of lines in text rewrite           map files to align behaviour with Apache httpd. Pull request           provided by Chenjp.
        - Fix: 69706: Saved request serialization issue in FORM introduced           when allowing infinite session timeouts.
        - Fix: Expand the path checks for Pre-Resources and Post-Resources           mounted at a path within the web application.
        - Fix: Use of SSS in SimpleDateFormat pattern for AccessLogValve.
        - Fix: Process possible path parameters rewrite production in the           rewrite valve.
        - Fix: 69588: Enable allowLinking to be set on PreResources,           JarResources and PostResources. If not set explicitly, the setting           will be inherited from the Resources.
        - Add: 69633: Support for Filters using context root mappings.
        - Fix: 69643: Optimize directory listing for large amount of files.
          Patch submitted by Loic de l'Eprevier.
        - Fix: #843: Off by one validation logic for partial PUT ranges and           associated test case. Submitted by Chenjp.
        - Refactor: Replace the unused buffer in           org.apache.catalina.connector.InputBuffer with a static, zero           length buffer.
        - Refactor: GCI servlet to access resources via the WebResource API.
        - Fix: 69662: Report name in exception message when a naming lookup           failure occurs. Based on code submitted by Donald Smith.
        - Fix: Ensure that the FORM authentication attribute           authenticationSessionTimeout works correctly when sessions have an           infinite timeout when authentication starts.
        - Add: Provide a content type based on file extension when web           application resources are accessed via a URL.
      * Coyote
        - Refactor: #861: TaskQueue to use the new interface RetryableQueue           which enables better integration of custom Executors which provide           their own BlockingQueue implementation. Pull request provided by           Paulo Almeida.
        - Add: Finer grained control of multi-part request processing via two           new attributes on the Connector element. maxPartCount limits the           total number of parts in a multi-part request and maxPartHeaderSize           limits the size of the headers provided with each part. Add support           for these new attributes to the ParameterLimitValve.
        - Refactor: The SavedRequestInputFilter so the buffered data is used           directly rather than copied.

      * Jasper:

        + Fix: 69696: Mark the JSP wrapper for reload after a failed           compilation.
        + Fix: 69635: Add support to jakarta.el.ImportHandler for resolving           inner classes.
        + Add: #842: Support for optimized execution of c:set and c:remove           tags, when activated via JSP servlet param           useNonstandardTagOptimizations.
        + Fix: An edge case compilation bug for JSP and tag files on case           insensitive file systems that was exposed by the test case for           69635.

      * Web applications:

        + Fix: 69694: Improve error reporting of deployment tasks done using           the manager webapp when a copy operation fails.
        + Add: 68876: Documentation. Update the UML diagrams for server           start-up, request processing and authentication using PlantUML and           include the source files for each diagram.

      * Other:

        + Add: Thread name to webappClassLoader.stackTraceRequestThread           message. Patch provided by Felix Zhang.
        + Update: Tomcat Native to 2.0.9.
        + Update: The internal fork of Apache Commons FileUpload to 1.6.0-RC1           (2025-06-05).
        + Update: EasyMock to 5.6.0.
        + Update: Checkstyle to 10.25.0.
        + Fix: Use the full path when the installer for Windows sets calls           icacls.exe to set file permissions.
        + Update: Improvements to Japanese translations provided by tak7iji.
        + Fix: Set sun.io.useCanonCaches in service.bat Based on pull request           #841 by Paul Lodge.
        + Update: Jacoco to 0.8.13.
        + Code: Explicitly set the locale to be used for Javadoc. For           official releases, this locale will be English (US) to support           reproducible builds.
        + Update: Byte Buddy to 1.17.5.
        + Update: Checkstyle to 10.23.1.
        + Update: File extension to media type mappings to align with the           current list used by the Apache Web Server (httpd).
        + Update: Improvements to French translations.
        + Update: Improvements to Japanese translations provided by tak7iji.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02214-1 advisory.

    - CVE-2025-46701: Refactored CGI servlet to access resources via WebResources (bsc#1243815).
     - CVE-2025-48988: Limited the total number of parts in a multi-part request and limits the size of the     headers provided with each part (bsc#1244656).
     - CVE-2025-49125: Expand checks for webAppMount (bsc#1244649).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1031 advisory.

    Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security     constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI     servlet.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from     9.0.0.M1 through 9.0.104.

    Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.
    (CVE-2025-46701)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1030 advisory.

    Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security     constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI     servlet.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from     9.0.0.M1 through 9.0.104.

    Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.
    (CVE-2025-46701)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 9.0.105-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2025-019 advisory.

    Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security     constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI     servlet.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from     9.0.0.M1 through 9.0.104.

    Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.
    (CVE-2025-46701)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.105, 10.1.0-M1 prior to 10.1.41 or 11.0.0-M1 prior to 11.0.7. It is, therefore, affected by a CGI security sonstraint bypass.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.7. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_11.0.7_security-11 advisory.

  - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security     constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI     servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40,     from 9.0.0.M1 through 9.0.104. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105,     which fixes the issue. (CVE-2025-46701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.41. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.41_security-10 advisory.

  - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security     constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI     servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40,     from 9.0.0.M1 through 9.0.104. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105,     which fixes the issue. (CVE-2025-46701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.105. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.105_security-9 advisory.

  - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security     constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI     servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40,     from 9.0.0.M1 through 9.0.104. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105,     which fixes the issue. (CVE-2025-46701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241962	SUSE SLES15 / openSUSE 15 Security Update : tomcat (SUSE-SU-2025:02280-1)	Nessus	SuSE Local Security Checks	high
241675	SUSE SLES15 / openSUSE 15 Security Update : tomcat10 (SUSE-SU-2025:02261-1)	Nessus	SuSE Local Security Checks	high
241342	SUSE SLES12 Security Update : tomcat (SUSE-SU-2025:02214-1)	Nessus	SuSE Local Security Checks	high
241155	Photon OS 4.0: Apache PHSA-2025-4.0-0823	Nessus	PhotonOS Local Security Checks	high
241060	Photon OS 5.0: Apache PHSA-2025-5.0-0537	Nessus	PhotonOS Local Security Checks	high
240330	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-1031)	Nessus	Amazon Linux Local Security Checks	medium
240324	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1030)	Nessus	Amazon Linux Local Security Checks	medium
240302	Amazon Linux 2 : tomcat (ALASTOMCAT9-2025-019)	Nessus	Amazon Linux Local Security Checks	medium
114877	Apache Tomcat 9.0.0-M1 < 9.0.104 CGI Security Constraint Bypass	Web App Scanning	Component Vulnerability	medium
114876	Apache Tomcat 10.1.0-M1 < 10.1.41 CGI Security Constraint Bypass	Web App Scanning	Component Vulnerability	medium
114875	Apache Tomcat 11.0.0-M1 < 11.0.7 CGI Security Constraint Bypass	Web App Scanning	Component Vulnerability	medium
237500	Apache Tomcat 11.0.0.M1 < 11.0.7	Nessus	Web Servers	medium
237499	Apache Tomcat 10.1.0.M1 < 10.1.41	Nessus	Web Servers	medium
237498	Apache Tomcat 9.0.0.M1 < 9.0.105	Nessus	Web Servers	medium

Detections

Analytics

CVE-2025-46701

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium