Two security flaws in Apache Tomcat's Rewrite Valve are fixed in this Red Hat security update. CVE-2025-31651 permits bypassing rewrite rules, potentially undermining intended access controls. CVE-2025-55752 allows directory traversal through rewrite rules, which could be exploited to achieve remote code execution. The update addresses these vulnerabilities in the tomcat packages for Red Hat Enterprise Linux 8 across multiple architectures. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat Product Security.

Successful exploitation of CVE-2025-31651 could allow attackers to bypass rewrite rules, potentially exposing restricted resources. CVE-2025-55752 could enable attackers to perform directory traversal attacks via rewrite rules, possibly leading to remote code execution on affected systems. This poses a significant security risk to systems running vulnerable versions of Apache Tomcat on Red Hat Enterprise Linux 8.

Red Hat has released updated tomcat packages (version 9.0.87-1.el8_10.7) that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the provided patches.