Apache Tomcat versions from 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, and 9.0.40 through 9.0.108 contain a vulnerability where ANSI escape sequences in log messages are not properly escaped. When Tomcat runs in a Windows console that supports ANSI sequences, an attacker can craft URLs that inject these sequences to manipulate the console display and clipboard. This could potentially deceive administrators into running malicious commands. The vulnerability is tracked as CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences). Although no attack vector has been confirmed, the issue might affect other operating systems. Users are advised to upgrade to Apache Tomcat 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later where the issue is fixed.

Successful exploitation could allow an attacker to manipulate the console output and clipboard of administrators running Tomcat in a Windows console environment, potentially tricking them into executing attacker-controlled commands. This could lead to complete compromise of the affected system. The CVSS score of 9.6 reflects critical impact on confidentiality, integrity, and availability. No known exploits have been observed in the wild to date.

A fix is available. Users should upgrade affected Apache Tomcat versions to 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later to remediate this vulnerability. No alternative mitigations are indicated. Patch status is confirmed by the vendor advisory recommending these versions.