CVE-2026-25854 Apache Tomcat: Occasionally open redirect
An attacker can redirect users to untrusted sites via the LoadBalancerDrainingValve, requiring specific configuration to exploit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-25854?
CVE-2026-25854 is a medium-severity vulnerability in Apache Tomcat, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected
Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
Weakness: CWE-601
Which versions are affected by CVE-2026-25854?
19 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.53 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.53 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.30 | 9.0.116 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.30 | 9.0.116 |
13 more packages
tomcat Bitnami | From 8.5.30 | 9.0.116, 10.1.53, 11.0.20 |
org.apache.tomcat:tomcat Maven | From 10.1.0-M1 | 10.1.53 |
org.apache.tomcat:tomcat Maven | From 10.1.0-M1 | 10.1.53 |
org.apache.tomcat:tomcat Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat:tomcat Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat:tomcat Maven | From 8.5.30 | 9.0.116 |
org.apache.tomcat:tomcat Maven | From 8.5.30 | 9.0.116 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.53 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.53 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.30 | 9.0.116 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.30 | 9.0.116 |
Products include Apache Tomcat.
How do I fix CVE-2026-25854?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.53, 11.0.20 or 9.0.116.
Is CVE-2026-25854 being exploited?
There is no known exploitation of CVE-2026-25854 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2026-25854, CLEANSTART-2026-DH42386, CLSA-2026-1776386111, CLSA-2026-1776818210, CLSA-2026-1792687172, DEBIAN-CVE-2026-25854 and 3 more.