Executive brief
Apache Tomcat is a widely used web server and application container for Java-based websites. A security flaw in its URL rewriting component could allow an attacker to hijack a user's session. If successful, this could lead to unauthorized access to sensitive user data or account takeover.
Technical details
A session fixation vulnerability (CWE-384) exists in Apache Tomcat's rewrite valve component. The flaw allows an attacker to establish a known session identifier for a user, which Tomcat fails to properly invalidate or rotate during authentication or session establishment. This network-based attack requires minimal user interaction and can result in the compromise of session confidentiality. The issue is resolved in versions 9.0.106, 10.1.42, and 11.0.8.
Affected products
- Apache Tomcat 9.0.0.M1 to 9.0.105, 10.1.0-M1 to 10.1.41, 11.0.0-M1 to 11.0.7
Timeline
- 2025-08-13: disclosed
- 2025-08-13: advisory
References
- https://api.github.com/users/yusuke-koyoshi
- https://github.com/yusuke-koyoshi
- https://api.github.com/users/yusuke-koyoshi/gists%7B/gist_id%7D
- https://api.github.com/users/yusuke-koyoshi/repos
- https://avatars.githubusercontent.com/u/92022336?v=4
- https://api.github.com/users/yusuke-koyoshi/events%7B/privacy%7D