PT-2026-31697 · Apache+1 · Apache Tomcat+1

Gregk4Sec · CVE-2026-25854 · Published 2026-03-23 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M23 through 9.0.115, and 8.5.30 through 8.5.100.

Description An open redirect issue exists in Apache Tomcat due to a flaw in the LoadBalancerDrainingValve. This can lead to redirection to untrusted sites.

Recommendations Upgrade to version 11.0.20, 10.1.53, or 9.0.116.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2026-06933

BIT-TOMCAT-2026-25854

CVE-2026-25854

GHSA-9M3C-QCXR-9X87

MGASA-2026-0095

OESA-2026-1970

OPENSUSE-SU-2026:10547-1

OPENSUSE-SU-2026:10548-1

OPENSUSE-SU-2026:10549-1

OPENSUSE-SU-2026:20595-1

OPENSUSE-SU-2026:20611-1

OPENSUSE-SU-2026:20612-1

RHSA-2026:20405

SUSE-SU-2026:1558-1

SUSE-SU-2026:1572-1

SUSE-SU-2026:1603-1

SUSE-SU-2026:1604-1

SUSE-SU-2026:21366-1

SUSE-SU-2026:21378-1

SUSE-SU-2026:21379-1

Affected Products

Apache Tomcat

Red Os

References · 86

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25854.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-25854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34500 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1603-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m3c-qcxr-9x87 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10548-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1558-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20611-1 · Vendor Advisory
• https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1970 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10547-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32990 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29146 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1572-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34483 · Security Note