Red Hat Product Security released an advisory (RHSA-2025:23047) for Apache Tomcat vulnerabilities affecting Red Hat Enterprise Linux 9.4 Extended Update Support. The advisory addresses two vulnerabilities: CVE-2025-31651, which allows bypassing rules in the Rewrite Valve, and CVE-2025-55752, which allows directory traversal via rewrite with possible remote code execution. The affected packages are updated to tomcat-9.0.87-1.el9_4.7. The advisory includes multiple updated RPM packages for various architectures. No CVSS scores are provided in the advisory, but the update is rated as Important by Red Hat. No known exploits in the wild have been reported at the time of the advisory.

Successful exploitation of CVE-2025-31651 could allow an attacker to bypass rewrite rules in the Tomcat Rewrite Valve, potentially altering request handling. CVE-2025-55752 could allow directory traversal via rewrite rules, which may lead to remote code execution. These vulnerabilities could compromise the confidentiality, integrity, and availability of affected systems running vulnerable Tomcat versions. The advisory rates the impact as Important, indicating a high severity but not critical. No known active exploitation has been reported.

Red Hat has released updated Tomcat packages (version 9.0.87-1.el9_4.7) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.4 Extended Update Support should apply the provided security update promptly. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation depends on applying the vendor-provided update. No additional mitigation steps are indicated in the advisory.