This advisory covers two security vulnerabilities in Apache Tomcat as packaged by Red Hat for Red Hat Enterprise Linux 9.2. The first vulnerability (CVE-2025-31651) involves a bypass of rules in the Rewrite Valve component. The second vulnerability (CVE-2025-55752) involves directory traversal via rewrite functionality, which could potentially lead to remote code execution. Red Hat has released updated Tomcat packages (version 9.0.87-1.el9_2.7) that address these issues. The advisory references Red Hat Bugzilla entries BZ-2362782 and BZ-2406591 for the respective CVEs and directs users to official update instructions.

The vulnerabilities allow attackers to bypass rewrite rules and perform directory traversal attacks, potentially leading to remote code execution on affected systems running Apache Tomcat. This could compromise the confidentiality, integrity, and availability of the affected server. The advisory classifies the security impact as Important, indicating a high risk but not critical.

Red Hat has released updated Tomcat packages for Red Hat Enterprise Linux 9.2 that fix these vulnerabilities. Users should apply the official security update as described in the Red Hat advisory RHSA-2025:23046 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.