What is the CVSS score of CVE-2025-55754?

CVE-2025-55754 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Apache Tomcat are affected by CVE-2025-55754?

Apache Tomcat versions 9.0.40-9.0.108, 10.1.0-M1-10.1.44, and 11.0.0-M1-11.0.10 contain a critical ANSI escape sequence injection vulnerability that allows attackers to manipulate console output and…. A patch is available.

How to fix or mitigate CVE-2025-55754?

Within 24 hours: Identify all Tomcat instances in your environment using affected versions (9.0.40-9.0.108, 10.1.0-M1-10.1.44, 11.0.0-M1-11.0.10) and document their Windows deployment status. Within 7 days: Implement interim mitigations (see compensating controls) for production systems; disable console logging where feasible and restrict administrator access to live log streams. Within 30 days: Monitor Apache Tomcat security advisories for patch release; plan upgrade to patched version immediately upon availability.

Apache Tomcat CVE-2025-55754

CRITICAL

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2025-10-27 security@apache.org

Microsoft Apache Tomcat Code Injection Red Hat Suse

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

3.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 13:32 vuln.today

CVE Published

Oct 27, 2025 - 18:15 nvd

CRITICAL 9.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 11.0.0-M1 and other introduced versions.

DescriptionCVE.org

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.

Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

AnalysisAI

ANSI escape sequence injection in Apache Tomcat log messages enables console manipulation and social engineering attacks against administrators on Windows systems. Attackers can craft malicious URLs that inject escape sequences into Tomcat logs, potentially manipulating console output and clipboard contents to trick administrators into executing attacker-controlled commands. This affects Tomcat 9.0.40-9.0.108, 10.1.0-M1-10.1.44, and 11.0.0-M1-11.0.10, with highest risk when Tomcat runs in ANSI-capable Windows consoles. Despite the 9.6 CVSS score, real-world risk is lower as exploitation requires user interaction (administrator viewing logs in console), scope change indicating console compromise beyond Tomcat process, and specific Windows deployment configuration. No active exploitation confirmed (not in CISA KEV), and EPSS data not available at time of analysis.

Technical ContextAI

CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences) represents a failure to sanitize control characters that affect output rendering. ANSI escape sequences are special character combinations (e.g., ESC[...m for colors, ESC]...BEL for clipboard operations) interpreted by terminal emulators to control cursor position, colors, and in some cases system clipboard. Apache Tomcat's logging subsystem failed to escape these sequences in log output, allowing attacker-controlled data from HTTP requests (URLs, headers) to pass through to log files unfiltered. When administrators view these logs in ANSI-capable Windows consoles (Command Prompt with VT sequences enabled in Windows 10+, or terminals like Windows Terminal), the escape sequences execute, enabling text manipulation, fake error messages, or clipboard injection. The vulnerability exists in Tomcat's core logging mechanism affecting all three CPE-identified product lines: Tomcat 9.x (cpe:2.3:a:apache:tomcat 9.0.40-9.0.108), 10.x (10.1.0-M1-10.1.44), and 11.x (11.0.0-M1-11.0.10), plus EOL 8.5.60-8.5.100.

RemediationAI

Upgrade to vendor-released patched versions: Apache Tomcat 11.0.11 or later for 11.x deployments, 10.1.45 or later for 10.x deployments, or 9.0.109 or later for 9.x deployments, as specified in the Apache advisory at https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd. These versions implement proper ANSI escape sequence sanitization in log output. For systems running EOL versions 8.5.x or older that cannot be upgraded, implement compensating controls: configure Tomcat to run as a Windows service rather than in an interactive console, use log aggregation tools that don't interpret ANSI sequences (Splunk, ELK, plaintext editors), disable VT sequence processing in Windows console properties, or restrict administrator log access to remote viewing methods. Note that running as a service is standard production practice and eliminates console-based exploitation vectors entirely, though log file injection persists and could affect other tools. Organizations using Siemens products should consult https://cert-portal.siemens.com/productcert/html/ssa-032379.html for product-specific guidance. No configuration-based workaround eliminates the vulnerability without upgrading.

More in Tomcat

View all

CVE-2017-12617 HIGH Act Now POC

8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

CVE-2016-8735 CRITICAL Act Now POC

9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8

CVE-2017-12615 HIGH Act Now POC

8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2014-0050 HIGH Act Now POC

7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,

CVE-2017-12616 HIGH Act Now

7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2014-0227 MEDIUM This Month

6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and

CVE-2013-5528 MEDIUM This Month POC

4.0 Oct 11

Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager all

CVE-2016-6808 CRITICAL Emergency POC

9.8 Apr 12

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Rated critical severity (CVSS 9.8), this vulnerabili

CVE-2016-1240 HIGH Act Now POC

7.8 Oct 03

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

CVE-2016-5425 HIGH Act Now POC

7.8 Oct 13

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distribu

CVE-2022-22965 CRITICAL Act Now POC

9.8 Apr 01

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

CVE-2025-31650 HIGH Act Now POC

7.5 Apr 28

Improper Input Validation vulnerability in Apache Tomcat. Rated high severity (CVSS 7.5), this vulnerability is remotely

Same weakness CWE-150 – Improper Neutralization of Escape, Meta, or Control Sequences

View all

CVE-2017-0899 CRITICAL POC

9.8

CVE-2023-26055 CRITICAL POC

9.9

CVE-2026-25996 CRITICAL POC

9.8

CVE-2023-28446 HIGH POC

8.8

CVE-2023-40185 HIGH POC

8.6

CVE-2024-36052 HIGH POC

7.5

CVE-2024-33899 HIGH POC

7.1

CVE-2025-25286 CRITICAL

9.8

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

8.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

CVE-2018-1273 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
Container suse/manager/5.0/x86_64/server:5.0.6.7.36.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.1.8.10.2 Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE	Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/base-os-container:2.2.0-4.48 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd	Affected
SUSE Enterprise Storage 7.1	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

CVE-2025-55754 vulnerability details – vuln.today

Back

Apache Tomcat CVE-2025-55754

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Tomcat

Same weakness CWE-150 – Improper Neutralization of Escape, Meta, or Control Sequences

Same technique Code Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code