Apache Tomcat versions from 11.0.0 through 11.0.6, 10.1.0 through 10.1.40, 9.0.0 through 9.0.104, and 8.5.0 through 8.5.100 (EOL) are affected by a vulnerability (CVE-2025-46701) due to improper handling of case sensitivity in the CGI servlet. This flaw allows security constraint bypass for constraints applied to the pathInfo component of a URI mapped to the CGI servlet. The vulnerability could be exploited to bypass authentication mechanisms. The issue is addressed by upgrading to fixed versions 11.0.7, 10.1.41, or 9.0.105. The Ubuntu advisory confirms the vulnerability and recommends applying updates available via standard system updates or Ubuntu Pro ESM for affected Ubuntu releases.

The vulnerability allows an attacker to bypass security constraints related to the pathInfo component in the CGI servlet, potentially enabling unauthorized access by circumventing authentication mechanisms. This could lead to unauthorized access to protected resources on affected Apache Tomcat servers. The severity is rated high due to the authentication bypass nature of the flaw.

A fix is available. Users should upgrade Apache Tomcat to versions 11.0.7, 10.1.41, or 9.0.105 or later. For Ubuntu users, applying standard system updates or using Ubuntu Pro Extended Security Maintenance (ESM) for affected LTS releases will address the vulnerability. No additional mitigation steps are indicated beyond applying these updates.