Description
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | 10.1.53 | affected |
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | 11.0.20 | affected |
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | 9.0.116 | affected |
| jws7-tomcat | Red Hat / Red Hat JBoss Web Server 7.0 on RHEL 10 | >= 0:11.0.21-5.redhat_00004.1.el10jws, < * | unaffected |
| jws7-tomcat | Red Hat / Red Hat JBoss Web Server 7.0 on RHEL 8 | >= 0:11.0.21-5.redhat_00004.1.el8jws, < * | unaffected |
| jws7-tomcat | Red Hat / Red Hat JBoss Web Server 7.0 on RHEL 9 | >= 0:11.0.21-5.redhat_00004.1.el9jws, < * | unaffected |
| pki-deps:10.6/pki-servlet-engine | Red Hat / Red Hat Enterprise Linux 8 | any version | unknown |
| pki-servlet-engine | Red Hat / Red Hat Enterprise Linux 9 | any version | unknown |
| tomcat | Red Hat / Red Hat JBoss Web Server 6 | any version | unknown |
| tomcat | Red Hat / Red Hat JBoss Web Server 7.0.0 | any version | unknown |
| tomcat | Red Hat / Red Hat JBoss Web Server 5 | any version | unknown |
| tomcat | Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Support | >= 0:7.0.76-18.el7_9, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support | >= 1:10.1.36-2.el10_0, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 10 | >= 1:10.1.49-3.el10_2, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 9 | >= 1:9.0.117-2.el9_8, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 8 | >= 1:9.0.87-2.el8_10, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | >= 1:9.0.87-2.el8_8, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service | >= 1:9.0.87-2.el8_8, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | >= 1:9.0.87-2.el9_2, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | >= 1:9.0.87-2.el9_4, < * | unaffected |
| tomcat | Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support | >= 1:9.0.87-4.el9_6, < * | unaffected |
| tomcat6 | Red Hat / Red Hat Enterprise Linux 6 | any version | unknown |
| tomcat9 | Red Hat / Red Hat Enterprise Linux 10 | >= 1:9.0.117-2.el10_2, < * | unaffected |
| tomcat9 | Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support | >= 1:9.0.87-6.el10_0, < * | unaffected |