CVE-2026-25854: Apache Tomcat: Occasionally open redirect

[Mark Thomas <markt () apache org>]

Severity: low

Affected versions:

- Apache Tomcat 11.0.0-M1 through 11.0.18
- Apache Tomcat 10.1.0-M1 through 10.1.52
- Apache Tomcat 9.0.0.M23 through 9.0.115
- Apache Tomcat 8.5.30 through 8.5.100
- Apache Tomcat through 7.0.109 unaffected

Description:

Occasional URL redirection to untrusted Site ('Open Redirect') 
vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 
10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 
through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, 
which fix the issue.

Credit:

gregk4sec (https://github.com/gregk4sec) (finder)

References:

https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0
https://tomcat.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-25854