CVE-2025-46701

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

Scoring

Severity

HIGH

CVSS base score

7.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS probability

2.93%

CWE

CWE-178

Published

2025-05-29

Last modified

2026-09-17

Affected products

• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat

Weakness type

• CWE-178

Related vulnerabilities

• CVE-2023-3545 — Chamilo LMS Htaccess File Upload Security Bypass
• CVE-2023-4759 — Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write
• CVE-2026-43513 — Apache Tomcat: LockOutRealm treats user names as case-sensitive
• CVE-2025-67718 — Formio improperly authorized permission elevation through specially crafted request path
• CVE-2026-40453 — Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
• CVE-2021-39155 — Authorization Policy Bypass Due to Case Insensitive Host Comparison
• CVE-2026-47323 — Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering
• CVE-2026-28292 — simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

Markdown version · Browse all CVEs