Cyber Resilience

CVE-2025-46701

Apache Tomcat 9.0.0 – 9.0.105

Published
29 May 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v3.1 7.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.027 85th percentile
Risk Priority 61 floored blend · peak EPSS

Summary

CVE-2025-46701 is a high-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Apache Tomcat. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked in the top 15% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through…

more

11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-43513Same product: Apache Tomcat
CVE-2026-55957Same product: Apache Tomcat
CVE-2026-59083Same product: Apache Tomcat
CVE-2026-24880Same product: Apache Tomcat
CVE-2023-46589Same product: Apache Tomcat
CVE-2025-55752Same product: Apache Tomcat
CVE-2025-49125Same product: Apache Tomcat
CVE-2026-34483Same product: Apache Tomcat
CVE-2025-31651Same product: Apache Tomcat
CVE-2025-52520Same product: Apache Tomcat

Affected Assets

apache
tomcat
9.0.0 — 9.0.105 · 10.1.0 — 10.1.41 · 11.0.0 — 11.0.7

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Applying access control decisions to each request depends on accurate property determination that accounts for case differences.

Correct enforcement of authorizations for resource access structurally requires consistent case-sensitive handling of identifiers to avoid incorrect decisions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure SDLC practices should include case-sensitivity requirements in design and coding standards.

prevents

Application security requirements must specify case handling for identifiers and paths.

prevents

Architecture principles should enforce canonical, case-aware resource naming.

prevents

Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.

degrades

Access-control rules that ignore case can allow unintended resource access.

degrades

Authentication logic must treat identifiers consistently to avoid bypass via case differences.

References