Critical Flaws in Apache Tomcat

 The Apache Software Foundation has disclosed two serious vulnerabilities — CVE‑2025‑55752 and CVE‑2025‑55754 — affecting numerous versions of Apache Tomcat, the widely-used open-source Java servlet container that underpins many web applications, microservices, and enterprise platforms.

CVE-2025-55752: Path-Traversal with Possible RCE

• This vulnerability is described as a relative path traversal flaw in Tomcat.

• The root cause: a regression introduced by a prior bug fix (bug 60013) in which the rewritten URL was normalized before being decoded — an ordering error that opened a bypass. 

• The consequence: For installations using a Rewrite Valve (rewrite rules) that map query parameters into the URL, an attacker could craft URIs that circumvent security constraints (specifically protections around /WEB-INF/ or /META-INF/). 

• Under the additional condition that HTTP PUT requests are enabled, malicious files may be uploaded, leading to remote code execution (RCE). 

• Affected versions include: Tomcat 9.0.0.M11 through 9.0.108, 10.1.0-M1 through 10.1.44, 11.0.0-M1 through 11.0.10, and earlier end-of-life branches (e.g., 8.5.6 to 8.5.100) may also be impacted. 

• Recommended fixed versions are: 9.0.109, 10.1.45, 11.0.11 or later.

• Although the regression scenario is somewhat specialized (requiring rewrite + PUT enabled), the potential for RCE means it must be treated as high risk. 

CVE-2025-55754: ANSI Escape Sequence / Console Manipulation

• This second flaw is described as an improper neutralization of escape, meta or control sequences vulnerability in Tomcat’s logging handling. 

• Specifically: When Tomcat runs in a Windows console that supports ANSI escape sequences, a malicious URL could inject ANSI escape codes into log messages, which in turn could manipulate the console display, the clipboard, or trick an administrator into running attacker-controlled commands. 

• Affected versions: similarly, Tomcat 9.0.40 through 9.0.108, 10.1.0-M1 through 10.1.44, 11.0.0-M1 through 11.0.10, and older EOL branches. 

• While no confirmed active exploit vector is publicly known, the nature of the flaw (console manipulation, clipboard trickery) makes it dangerous in administrative or interactive environments.

• Fixes apply in the same versions as above (9.0.109, 10.1.45, 11.0.11+).

---

Why This Matters

• Tomcat is deeply embedded in Java-based enterprises, application servers, cloud platforms, embedded devices, and middleware. A flaw in Tomcat can propagate risk widely.

• In the first vulnerability (CVE-55752), although exploitation requires certain conditions (PUT enabled, rewrite rules in place) it opens a remote code execution vector — one of the top risks in cybersecurity.

• In the second (CVE-55754), the threat may be more subtle (console or clipboard manipulation) but when an administrator is interacting with a console or logs, the risk of mis-trusting malicious output is real.

• Attackers could combine CVE-55754 with social engineering (e.g., misleading console logs) plus CVE-55752 or other flaws for amplification.

• Organizations that run Tomcat in default configurations may believe they’re safe; but many application stacks are customized (rewrite valves, HTTP methods enabled) and thus may unknowingly be exposed.

---

Immediate Action Recommendations

1. Inventory your environment: Identify all instances of Tomcat in use (versions 9.x, 10.x, 11.x and legacy 8.5.x) including embedded or container-based deployments.

2. Assess configuration: Check if any of the following apply:

   • Rewrite Valve configurations that map query parameters into URLs

   • HTTP PUT methods enabled for file uploads or webDAV-style usage

   • Tomcat running with console logging on Windows interactive consoles (particularly for CVE-55754).

3. Patch promptly: Upgrade Tomcat to at least version 9.0.109, 10.1.45 or 11.0.11 as appropriate.

4. Compensating controls (while upgrades are scheduled):

   • Disable HTTP PUT method unless explicitly required.

   • Restrict access to management interfaces, logs and administrative consoles.

   • Monitor usage of rewrite rules; apply stricter URL validation.

   • On Windows systems, avoid running Tomcat in interactive consoles (prefer service mode) if possible, and sanitize logs.

5. Review logs for suspicious activity: Look for unusual PUT requests, rewrite rule anomalies, unexpected file uploads, or ANSI escape sequences in logs.

6. Test and validate: After patching, perform security testing (fuzzing, replaying rewrite rules) to confirm no bypass remains.

7. Communicate: Inform relevant stakeholders (DevOps, application owners, security teams) about the urgency of patching — delay increases the window of exposure.

---

Conclusion

These disclosures from the Apache Software Foundation serve as a timely reminder that even well-mature, widely-used platforms such as Apache Tomcat are vulnerable to subtle regressions and configuration-dependent flaws. The first vulnerability (CVE-2025-55752) offers clear potential for remote code execution under specific conditions, while the second (CVE-2025-55754) highlights the dangers of trusting administrative consoles and logs. For enterprises deploying Tomcat, this means reviewing both versioning and configuration aggressively, applying patches without delay, and applying defense-in-depth controls to mitigate risk.