CVE-2025-24813 Apache Tomcat
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.
- CVSS
- not scored
On CISA’s exploited list
Apache Tomcat Path Equivalence Vulnerability
- Added
- 2025-04-01
- Federal patch deadline
- 2025-04-22
- Ransomware use
- not known