This advisory covers three security vulnerabilities in Apache Tomcat as distributed by Red Hat for Enterprise Linux 10. CVE-2025-31651 involves bypassing rules in the Rewrite Valve component. CVE-2025-61795 is a denial of service vulnerability in the tomcat-catalina package. CVE-2025-55752 is a directory traversal vulnerability via rewrite functionality that may lead to remote code execution. Red Hat has released updated Tomcat packages (version 10.1.36-3.el10_1.1) to fix these issues. The advisory applies to multiple architectures including x86_64, s390x, ppc64le, and aarch64. The update is rated as having an important security impact by Red Hat Product Security.

Successful exploitation of these vulnerabilities could allow an attacker to bypass rewrite rules, cause denial of service conditions, or perform directory traversal potentially leading to remote code execution on affected systems running vulnerable versions of Apache Tomcat. This could compromise the confidentiality, integrity, and availability of the affected systems. However, there are no known exploits in the wild currently reported.

Red Hat has released updated Tomcat packages (version 10.1.36-3.el10_1.1) that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 should apply the security update promptly by following the instructions in the Red Hat advisory RHSA-2025:23050 and the update article at https://access.redhat.com/articles/11258. Applying this update will mitigate the described security issues.