CVE-2025-55668CWE-384

Apache Tomcat: session fixation via rewrite valve

Medium · published August 13, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00860 · 58.1th percentile
Weakness
CWE-384 · Session Fixation
Published
2025-08-13T13:21Z
EPSS history
Timeline
  • 13 AUG 13:21Z
    Apache Tomcat: session fixation via rewrite valve
    cvelistv5