Feed/CVE-2025-55668
CVE-2025-55668MEDIUMCVSS 6.5

Apache Tomcat Session Fixation vulnerability

Published Aug 13, 2025·Updated Jul 1, 2026

NVD Description

Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Affected Packages (2)

org.apache.tomcat:tomcat-catalinaMAVEN
From 11.0.0-M1
Fixed in 11.0.8
org.apache.tomcat.embed:tomcat-embed-coreMAVEN
From 11.0.0-M1
Fixed in 11.0.8

Public Exploits & PoCs1 found

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free