CRITICALCVSS 9.8Actively exploited · CISA KEV since 2025-04-01Vulnerability

CVE-2025-24813

Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.

Properties

Euvd product
Apache Tomcat
Vulnerability name
Apache Tomcat Path Equivalence Vulnerability
First seen
2025-10-29T11:49:44+00:00
Cvss score
9.8
Epss score
0.99927
Last seen
2026-10-19T12:00:27+00:00
Due date
2025-04-22
Euvd assigner
apache
Retrieved at
2026-10-21T01:24:47+00:00
Exploited euvd since
2025-04-01T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2025-04-01
Euvd base score version
3.1
Score
9.8
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
Apache Software Foundation
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
10

Related Entities (55 · showing 26)

AFFECTS_PRODUCT (49 · showing 20)

→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*

HAS_WEAKNESS (3)

→[Weakness]Deserialization of Untrusted Data
→[Weakness]CWE-44
→[Weakness]Use of Incorrectly-Resolved Name or Reference

DESCRIBES (1)

←[KEVEntry]Apache Tomcat Path Equivalence Vulnerability

INVOLVES (1)

←[Signal]kev_added · 2025-04-01

MENTIONED_IN (1)

→[Campaign]A China-Nexus Campaign Against Government Infrastructure

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2025-24813 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal