Red Hat Product Security released an advisory (RHSA-2025:23052) for Apache Tomcat 9 in Red Hat Enterprise Linux 10 addressing two vulnerabilities: CVE-2025-31651, which allows bypass of rules in the Rewrite Valve, and CVE-2025-55752, a directory traversal vulnerability via rewrite that could lead to possible remote code execution. The advisory updates tomcat9 packages to version 9.0.87-8.el10_1.1 to fix these issues. The vulnerabilities relate to CWE-150 (Improper Neutralization of Input During Web Page Generation) and CWE-23 (Relative Path Traversal). The update is classified as Important severity by Red Hat, though no CVSS base scores are provided. The advisory includes detailed package information and instructions for applying the update across supported architectures.

Successful exploitation of CVE-2025-31651 could allow an attacker to bypass rewrite rules in the Tomcat Rewrite Valve, potentially altering request handling. CVE-2025-55752 involves directory traversal via rewrite rules, which may enable an attacker to access unauthorized files or execute code remotely. These vulnerabilities could compromise the confidentiality, integrity, and availability of affected systems running Tomcat 9 on Red Hat Enterprise Linux 10. No known exploits in the wild have been reported, but the potential for remote code execution elevates the risk.

Red Hat has released an official security update for tomcat9 in Red Hat Enterprise Linux 10, specifically version 9.0.87-8.el10_1.1, which addresses these vulnerabilities. Users should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated in the advisory. Patch status is confirmed as fixed in the updated tomcat9 package.