CVE-2025-55754: Apache Tomcat vulnerability (CVSS 9.6)

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Apache Tomcat≥ 10.0.0 < 10.0.27 · ≥ 10.1.0 < 10.1.45 · ≥ 11.0.0 < 11.0.11 · ≥ 8.5.60 ≤ 8.5.100

Remediation

Fixed in

Apache Tomcat≥ 10.0.27

Patch & vendor advisories

https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd

References

https://cert-portal.siemens.com/productcert/html/ssa-032379.html
https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqdMailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2025/10/27/5Mailing ListThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-55754 being actively exploited?

CVE-2025-55754 is not in the CISA KEV catalog. Its EPSS exploit probability is 10.2%.

How severe is CVE-2025-55754?

CVE-2025-55754 has a CVSS 3.1 base score of 9.6, rated critical. EPSS estimates a 10.2% probability of exploitation.

Which products are affected by CVE-2025-55754?

Affected products include Apache Tomcat.

How do I fix CVE-2025-55754?

Upgrade affected software to a fixed version, for example Apache Tomcat 10.0.27 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-55754 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo