The advisory covers two security vulnerabilities in Apache Tomcat components within the pki-servlet-engine package for Red Hat Enterprise Linux 9.0. CVE-2025-31651 is a bypass of rules in the Rewrite Valve, which controls URL rewriting. CVE-2025-55752 is a directory traversal vulnerability via rewrite rules that could potentially lead to remote code execution. These vulnerabilities affect the servlet engine used for Java Servlet and JavaServer Pages implementations. Red Hat has issued a security update (pki-servlet-engine-9.0.43-4.el9_0.2) to fix these issues. The update is available for multiple architectures including x86_64, ppc64le, aarch64, and s390x. No known exploits in the wild have been reported at the time of the advisory.

Successful exploitation of CVE-2025-31651 could allow bypassing of rewrite rules, potentially enabling unauthorized URL manipulations. CVE-2025-55752 could allow an attacker to perform directory traversal attacks via crafted rewrite rules, which may lead to remote code execution on affected systems. This poses a significant security risk, especially on systems running vulnerable versions of the pki-servlet-engine component. The vulnerabilities affect the core servlet engine used in Java web applications, potentially impacting confidentiality, integrity, and availability of affected systems.

Red Hat has released an official security update for the pki-servlet-engine package (version 9.0.43-4.el9_0.2) that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply this update promptly. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed as fixed in the referenced package version.