BIT-tomcat-2025-55668

vendorUSosv

Apache Tomcat: session fixation via rewrite valve

view advisory published 2025-08-18Licence: per source

Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.0 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-55668US	—	0.86% (58th)	Exploit	2025-08-13
Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 t…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/08/13/3WEB
https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-55668WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan