CVE-2025-46701 Details
Description
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.
A vulnerability in Apache Tomcat's CGI servlet has been identified, allowing for a bypass of security constraints applied to the pathInfo component of a URI mapped to the CGI servlet. This issue arises from improper handling of case sensitivity, particularly on case-insensitive file systems. The vulnerability affects Apache Tomcat versions 11.0.0-M1 through 11.0.6, 10.1.0-M1 through 10.1.40, and 9.0.0.M1 through 9.0.104.
Users are advised to upgrade to Apache Tomcat versions 11.0.7, 10.1.41, or 9.0.105.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html | CVE | |
| http://www.openwall.com/lists/oss-security/2025/05/29/4 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache tomcat | >= 9.0.0, < 9.0.105 >= 10.1.0, < 10.1.41 >= 11.0.0, < 11.0.7 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Aug 8, 2025 | CVE Modified | [email protected] |
| Aug 7, 2025 | CVE Modified | [email protected] |
| Jun 25, 2025 | Initial Analysis | [email protected] |
| May 30, 2025 | CVE Modified | CISA-ADP |
| May 29, 2025 | CVE Modified | CVE |
| May 29, 2025 | New CVE Received | [email protected] |