CVE-2025-46701: Apache Tomcat: Security constraint bypass for CGI scripts

[Mark Thomas <markt () apache org>]

Severity: low

Affected versions:

- Apache Tomcat 11.0.0-M1 through 11.0.6
- Apache Tomcat 10.1.0-M1 through 10.1.40
- Apache Tomcat 9.0.0.M1 through 9.0.104

Description:

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's 
GCI servlet allows security constraint bypass of security constraints 
that apply to the pathInfo component of a URI mapped to the CGI servlet.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 
10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.

Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, 
which fixes the issue.

Credit:

Greg K (https://github.com/gregk4sec) (finder)

References:

https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j
https://tomcat.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-46701