Vulnerability DatabaseCVE-2025-55668
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-55668
Published:August 13, 2025
Updated:June 07, 2026
Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Affected Packages
https://github.com/apache/tomcat.git (GITHUB):
Affected version(s) >=9.0.0-M1 <9.0.106
Fix Suggestion:
Update to version 9.0.106
https://github.com/apache/tomcat.git (GITHUB):
Affected version(s) >=11.0.0-M1 <11.0.8
Fix Suggestion:
Update to version 11.0.8
https://github.com/apache/tomcat.git (GITHUB):
Affected version(s) >=10.1.0-M1 <10.1.42
Fix Suggestion:
Update to version 10.1.42
org.apache.tomcat.embed:tomcat-embed-core (JAVA):
Affected version(s) >=10.1.0-M1 <10.1.42
Fix Suggestion:
Update to version 10.1.42
org.apache.tomcat:tomcat-catalina (JAVA):
Affected version(s) >=9.0.0.M1 <9.0.106
Fix Suggestion:
Update to version 9.0.106
org.apache.tomcat.embed:tomcat-embed-core (JAVA):
Affected version(s) >=11.0.0-M1 <11.0.8
Fix Suggestion:
Update to version 11.0.8
Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (12)
https://nvd.nist.gov/vuln/detail/CVE-2025-55668
https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47
https://tomcat.apache.org/security-9.html
http://www.openwall.com/lists/oss-security/2025/08/13/3
https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95
https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21
https://github.com/apache/tomcat
https://seclists.org/oss-sec/2025/q3/96
https://security-tracker.debian.org/tracker/CVE-2025-55668
https://tomcat.apache.org/security-10.html
https://tomcat.apache.org/security-11.html
https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6
Do you need more information?
Contact Us
CVSS v4
Base Score:
7.1
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Session Fixation
CWE-384
EPSS
Base Score:
0.02