CVE-2025-24813

Summary

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Severity

critical

EPSS

99.9% (p100)

Also known as

GHSA-83qj-6fr2-vhqg#org.apache.tomcat:tomcat-catalina, GHSA-83qj-6fr2-vhqg#org.apache.tomcat.embed:tomcat-embed-core, BIT-tomcat-2025-24813

Published

2025-03-10

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-24813
• https://github.com/apache/tomcat/commit/0a668e0c27f2b7ca0cc7c6eea32253b9b5ecb29c
• https://github.com/apache/tomcat/commit/eb61aade8f8daccaecabf07d428b877975622f72

Related advisories

• CVE-2026-41293 — critical · Maven/org.apache.tomcat:tomcat-catalina
• CVE-2026-43512 — critical · Maven/org.apache.tomcat:tomcat-catalina
• CVE-2026-43515 — critical · Maven/org.apache.tomcat:tomcat-catalina
• CVE-2024-52316 — critical · Maven/org.apache.tomcat:tomcat-catalina
• CVE-2016-8735 — critical · Maven/org.apache.tomcat:tomcat-catalina
• CVE-2026-41284 — high · Maven/org.apache.tomcat:tomcat-catalina
• CVE-2026-42498 — high · Maven/org.apache.tomcat:tomcat-catalina
• CVE-2026-43513 — high · Maven/org.apache.tomcat:tomcat-catalina

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity