CVE-2025-31651 is a Critical (CVSS 9.8 in the record) rewrite rule bypass in Apache Tomcat. Apache rates it Low. Upgrade to 11.0.6, 10.1.40 or 9.0.104, and check any rewrite rules that act as your only access control, since those are what the flaw lets a crafted request bypass.
What's affected
The Apache Tomcat security pages list the affected and fixed versions:
- Tomcat 11: 11.0.0-M1 to 11.0.5 affected, fixed in 11.0.6
- Tomcat 10.1: 10.1.0-M1 to 10.1.39 affected, fixed in 10.1.40
- Tomcat 9: 9.0.0.M1 to 9.0.102 affected, fixed in 9.0.104
The Tomcat 9 page notes that 9.0.103 was never released because its release vote did not pass, so you need 9.0.104 to get the fix. The record also says Tomcat 8.5.0 through 8.5.100 were end of life when the CVE was created but are known to be affected, and that older end of life versions may be too.
The issue: for a subset of unlikely rewrite rule configurations, a specially crafted request could bypass some rewrite rules. If those rules effectively enforced security constraints, the constraints could be bypassed. Apache rates the severity as Low for this reason. The NVD record scores it 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and lists the weakness as CWE-116. The record does not mark the CVE as in CISA KEV.
The gap between Low and Critical is real, and it is the key to triage: the score assumes the worst case, while the vendor describes a narrow configuration.
How to check if you're exposed
Check your Tomcat version:
$CATALINA_HOME/bin/version.sh
Compare it with the fixed versions above. Then check whether you use rewrite rules at all. Tomcat's rewrite support is provided by the rewrite valve. Search your configuration:
grep -rn "RewriteValve" $CATALINA_BASE/conf
find $CATALINA_BASE/conf -name "rewrite.config"
If neither returns anything, you do not use the rewrite valve and the narrow condition in the advisory does not apply to your instance, though updating is still the tidy answer. If a rewrite.config exists, read it and ask whether any rule is there to allow or block access to a path. Those are the rules the advisory describes as the risk.
Also check containers. Tomcat is often embedded in application images and in Spring Boot style fat jars, where the version is easy to overlook. Scan your images and build outputs for the Tomcat library version, not just standalone installs.
What to do now
- Upgrade Tomcat to 11.0.6, 10.1.40 or 9.0.104, or any later release in your line.
- If you run Tomcat 8.5, plan a move to a supported line, since 8.5 is end of life and known to be affected.
- Review your rewrite rules and remove any that act as your only security control. Enforce access control in the application or a security constraint in
web.xmlas well. - Scan application images and jars for embedded Tomcat versions and rebuild them with the patched library.
- Treat the vendor's Low rating and the NVD's Critical score as two inputs, and decide using what your configuration actually does.
Why it matters
This flaw is about meta characters: a request can contain escape or control sequences that the rewrite engine does not neutralize, so a rule written for the normal form of a path does not match the crafted form. The weakness is %s, improper encoding or escaping of output. The effect is a path where one rule says no and a slightly different spelling of the request slips past it.
The lesson is architectural. A rewrite rule is a routing tool, and using it as an access control makes the control only as strong as the pattern matching. Where you can, enforce who may see a path in the application or with a security constraint. Where you must keep both, test the rules with unusual encodings. And when two sources disagree on severity, as here, read the vendor's conditions before you spend a weekend on it, and still schedule the upgrade.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does Apache rate this Low while NVD shows Critical?
Apache describes it as affecting a subset of unlikely rewrite configurations where the rules enforce security constraints. The NVD score reflects the worst case without those conditions.
Is Tomcat 9.0.103 safe?
The Tomcat 9 page says the 9.0.103 release candidate vote did not pass, so it was not released. Use 9.0.104 or later.
Sources
Last reviewed: 19 October 2026.
