PT-2026-31697 · Apache+1 · Apache Tomcat+1

Gregk4Sec · Published 2026-03-23 · Updated 2026-05-06 · CVE-2026-25854

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M23 through 9.0.115, and 8.5.30 through 8.5.100.

Description An open redirect issue exists in Apache Tomcat due to a flaw in the LoadBalancerDrainingValve. This can lead to redirection to untrusted sites.

Recommendations Upgrade to version 11.0.20, 10.1.53, or 9.0.116.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2026-06933

BIT-TOMCAT-2026-25854

CVE-2026-25854

GHSA-9M3C-QCXR-9X87

MGASA-2026-0095

OESA-2026-1970

OPENSUSE-SU-2026:10547-1

OPENSUSE-SU-2026:10548-1

OPENSUSE-SU-2026:10549-1

OPENSUSE-SU-2026:20595-1

OPENSUSE-SU-2026:20611-1

OPENSUSE-SU-2026:20612-1

SUSE-SU-2026:1558-1

SUSE-SU-2026:1572-1

SUSE-SU-2026:1603-1

SUSE-SU-2026:1604-1

Affected Products

Apache Tomcat

Red Os

References · 84

• https://bdu.fstec.ru/vul/2026-06933 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29146 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10549-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25854 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1970 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20612-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25854 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m3c-qcxr-9x87 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34483 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20611-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29129 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20595-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-25854 · Vendor Advisory