Apache Tomcat April Vulnerability Security Update Advisory
Overview
Apache Tomcat(https://tomcat.apache.org/) has released a security update that fixes vulnerabilities in its shipped products. Users of affected products are advised to update to the latest version.
Affected Products
Apache Tomcat 9.0.76 – 9.0.102
Apache Tomcat 9.0.0.M1 – 9.0.102
Apache Tomcat 11.0.0-M2 – 11.0.5
Apache Tomcat 11.0.0-M1 – 11.0.5
Apache Tomcat 10.1.10 – 10.1.39
Apache Tomcat 10.1.0-M1 – 10.1.39
Resolved Vulnerabilities
Rewrite rule bypass vulnerability caused by a crafted request in Apache Tomcat (CVE-2025-31651)
Denial of Service attack vulnerability in Apache Tomcat caused by a memory leak (CVE-2025-31650)
Vulnerability Patches
Please follow the security advisory published on April 28, 2025 to update to the applicable version and the latest version.
Apache Tomcat 9.0.104
Apache Tomcat 11.0.6
Apache Tomcat 10.1.40
Referenced Sites
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31650