Red Hat Product Security issued an important security advisory (RHSA-2025:23051) for Apache Tomcat in Red Hat Enterprise Linux 10.0 EUS. The update fixes three vulnerabilities: CVE-2025-31651, which allows bypassing rules in the Rewrite Valve; CVE-2025-61795, a denial of service vulnerability in tomcat-catalina; and CVE-2025-55752, a directory traversal vulnerability via rewrite that may lead to remote code execution. The advisory provides updated tomcat packages (version 10.1.36-1.el10_0.3) for multiple architectures. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat.

Successful exploitation of these vulnerabilities could allow attackers to bypass rewrite rules, cause denial of service conditions, or perform directory traversal attacks potentially leading to remote code execution on affected systems running vulnerable versions of Apache Tomcat. This could compromise the confidentiality, integrity, and availability of the affected systems.

Red Hat has released updated tomcat packages (version 10.1.36-1.el10_0.3) that address these vulnerabilities. Users of Red Hat Enterprise Linux 10.0 Extended Update Support should apply the provided security update promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.