CVE-2025-55754
Apache Tomcat 8.5.60 – 8.5.100
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2025-55754 is a critical-severity Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150) vulnerability in Apache Tomcat. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-55754 is an Improper Neutralization of Escape, Meta, or Control Sequences vulnerability (CWE-150) in Apache Tomcat, where the software fails to escape ANSI escape sequences in log messages. This affects Tomcat versions from 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, and 9.0.40 through 9.0.108; end-of-life versions 8.5.60 through 8.5.100 are also vulnerable, as may be older EOL releases. The issue has a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), highlighting its critical potential impact.
An unauthenticated attacker over the network can exploit this by sending a specially crafted URL that injects ANSI escape sequences into Tomcat's log messages, provided the server runs in a console on Windows with ANSI support enabled. This allows manipulation of the console display and clipboard content, potentially tricking an administrator into executing an attacker-controlled command. While no specific attack vector was identified for other operating systems, the vulnerability may enable similar attacks there.
Apache advisories recommend upgrading to Tomcat 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later, which address the issue by properly escaping ANSI sequences in logs. Details are available in the official Apache security announcement at https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd and the oss-security mailing list post at http://www.openwall.com/lists/oss-security/2025/10/27/5.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-36225
Vulnerability Data
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape…
more
sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10V1.3.12
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation/sanitization of inputs that directly stops escape/meta/control sequences from reaching downstream components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and escaping to prevent this class of flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect the weakness but does not itself implement neutralization.
Secure development lifecycle mandates input validation and output encoding that directly neutralizes escape/meta sequences.
Application security requirements explicitly call for controls against injection and malformed input sequences.
Secure architecture principles reduce attack surface but do not prescribe specific neutralization techniques.
Secure coding standards require proper escaping and neutralization of control characters before downstream processing.