CVE Vulnerabilities

CVE-2025-46701

Improper Handling of Case Sensitivity

Published: May 29, 2025 | Modified: Aug 08, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
6.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Ubuntu
MEDIUM

Improper Handling of Case Sensitivity vulnerability in Apache Tomcats GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

Weakness

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Affected Software

Name Vendor Start Version End Version
Tomcat Apache 9.0.0 (including) 9.0.105 (excluding)
Tomcat Apache 10.1.0 (including) 10.1.41 (excluding)
Tomcat Apache 11.0.0 (including) 11.0.7 (excluding)
Tomcat10 Ubuntu esm-apps/noble *
Tomcat10 Ubuntu noble *
Tomcat10 Ubuntu oracular *
Tomcat10 Ubuntu plucky *
Tomcat10 Ubuntu upstream *
Tomcat11 Ubuntu devel *
Tomcat11 Ubuntu upstream *
Tomcat9 Ubuntu esm-apps/bionic *
Tomcat9 Ubuntu esm-apps/focal *
Tomcat9 Ubuntu esm-apps/jammy *
Tomcat9 Ubuntu focal *
Tomcat9 Ubuntu jammy *
Tomcat9 Ubuntu upstream *

Extended Description

Improperly handled case sensitive data can lead to several possible consequences, including:

Potential Mitigations

  • Assume all input is malicious. Use an “accept known good” input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, “boat” may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as “red” or “blue.”
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code’s environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

References