What is the CVSS score of CVE-2025-31651?

CVE-2025-31651 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Tomcat are affected by CVE-2025-31651?

CVE-2025-31651 presents critical security risk rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.. A patch is available.

How to fix or mitigate CVE-2025-31651?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Tomcat CVE-2025-31651

CRITICAL

Improper Encoding or Escaping of Output (CWE-116)

2025-04-28 security@apache.org

Authentication Bypass Apache Red Hat Tomcat Suse

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

5.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:39 vuln.today

CVE Published

Apr 28, 2025 - 20:15 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

249 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (12 direct, 237 indirect)
8 maven packages depend on org.apache.tomcat:tomcat-catalina (6 direct, 2 indirect)

Ecosystem-wide dependent count for version 9.0.76 and other introduced versions.

DescriptionCVE.org

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

AnalysisAI

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-116. Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. Affected products include: Apache Tomcat. Version information: through 11.0.5.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Tomcat

View all

CVE-2025-31650 HIGH Act Now POC

7.5 Apr 28

Improper Input Validation vulnerability in Apache Tomcat. Rated high severity (CVSS 7.5), this vulnerability is remotely

CVE-2026-33439 CRITICAL Act Now POC

9.3 Apr 07

Remote code execution in OpenIdentityPlatform OpenAM 16.0.5 and earlier allows unauthenticated attackers to execute arbi

CVE-2016-20026 CRITICAL Act Now POC

9.3 Mar 15

Critical hardcoded credentials vulnerability in ZKTeco ZKBioSecurity 3.0's bundled Apache Tomcat server that allows unau

CVE-2026-29146 HIGH This Week POC

7.5 Apr 09

Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7

CVE-2026-34486 HIGH This Week POC

7.5 Apr 09

Encryption bypass in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 allows unauthenticated remote attackers to circumvent t

CVE-2025-55752 HIGH This Week POC

7.5 Oct 27

Path traversal in Apache Tomcat versions 9.x through 11.x allows authenticated attackers to bypass security constraints

CVE-2025-41242 MEDIUM This Month POC

5.9 Aug 18

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant

CVE-2025-11165 CRITICAL Act Now

9.9 Feb 24

Sandbox escape in dotCMS Velocity scripting engine (VTools) allows authenticated users to execute arbitrary SQL. CVSS 9.

CVE-2026-45083 CRITICAL Act Now

9.8 May 13

Unauthenticated Solr streaming expression injection in Goobi viewer Core (versions 4.8.0 through 26.04) allows remote at

CVE-2026-43512 CRITICAL Act Now

9.8 May 12

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Ap

CVE-2026-41293 CRITICAL Act Now

9.8 May 12

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0

CVE-2025-55754 CRITICAL Act Now

9.6 Oct 27

ANSI escape sequence injection in Apache Tomcat log messages enables console manipulation and social engineering attacks

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all

CVE-2026-20245 HIGH POC

7.8

CVE-2026-22792 CRITICAL POC

9.6

CVE-2026-24737 HIGH POC

8.1

CVE-2025-59158 HIGH POC

8.0

CVE-2025-46347 MEDIUM POC

5.8

CVE-2026-28350 MEDIUM POC

6.1

CVE-2026-28348 MEDIUM POC

6.1

CVE-2025-55730 CRITICAL

10.0

Same technique Authentication Bypass

View all

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2025-3248 CRITICAL POC

9.8

CVE-2025-49113 CRITICAL POC

9.9

CVE-2020-5849 HIGH POC

7.5

CVE-2024-7593 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
Container suse/manager/5.0/x86_64/server:5.0.4.7.21.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE	Affected
SUSE Enterprise Storage 7.1	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed

CVE-2025-31651 vulnerability details – vuln.today

Back

Tomcat CVE-2025-31651

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Tomcat

Same weakness CWE-116 – Improper Encoding or Escaping of Output

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code