CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability

CVE-2025-24813 is a path equivalence vulnerability in Apache Tomcat that can let a remote attacker abuse partial PUT requests to execute code, disclose information, or inject malicious content. Because Tomcat is widely used as a Java application server for web apps and APIs, successful abuse can give an attacker a foothold on the host or access to application data. Confirm exact impact and conditions against the vendor advisory.

IT and security teams should treat this as a high-priority review item for any environment running Tomcat, especially where HTTP PUT or related write methods are reachable from untrusted networks.

How it works

The weakness is classified under path equivalence (CWE-44) and also involves deserialization concerns (CWE-502). In path-equivalence flaws, the server treats two different-looking paths as the same resource. An attacker can craft a partial PUT request that exploits how Tomcat normalizes or resolves the target path, potentially writing or overwriting content in an unintended location or triggering unsafe handling of that content.

According to the CISA summary, this can lead to remote code execution, information disclosure, or injection of malicious content. Exact request shape, required headers, and any preconditions (for example, whether PUT must already be enabled or whether a specific servlet or configuration is needed) are not detailed here; defenders must obtain those mechanics from the official Apache Tomcat advisory rather than assuming a particular exploit sequence.

Am I affected? How to find it in your systems

Apache Tomcat commonly runs as a standalone servlet container, as the engine behind many Java EE / Jakarta EE deployments, or embedded inside application packages and cloud images. Inventory every host, container, and PaaS instance that listens for HTTP/HTTPS and hosts Java web applications.

• Search package inventories, configuration-management databases, and container image registries for Tomcat installations and note the exact version string reported by the server or package manager.
• Review server.xml, web.xml, and any context or valve configuration that enables HTTP methods such as PUT, or that exposes write-capable endpoints.
• Check reverse proxies, load balancers, and WAFs in front of Tomcat for rules that allow partial or range-style PUT traffic to reach the backend.
• Look for log or telemetry signs of exploitation: unexpected PUT or partial-write requests, 2xx responses to unusual paths, sudden creation or modification of files under the web root or work directories, or process execution anomalies following such requests. Correlate with authentication and application logs.

Only the versions and configurations listed in the vendor advisory are confirmed affected; treat any unpatched Tomcat instance that accepts PUT-like requests as potentially in scope until verified.

How to remediate

Patch first. Apply the vendor-supplied update for Apache Tomcat that addresses CVE-2025-24813, following the instructions in the official advisory. After patching, restart the service and confirm the new version is running.

• Disable or tightly restrict the PUT method (and any related write methods) at the Tomcat connector, servlet, or reverse-proxy layer if the application does not require them.
• Ensure the process runs with least privilege and that the web root and work directories are not writable by the Tomcat user beyond what is strictly necessary.
• Review and harden any features that accept uploaded or partially written content, and keep deserialization surfaces minimal.
• For cloud-hosted or managed Tomcat services, follow applicable BOD 22-01 guidance and the provider’s mitigation instructions, or discontinue use if no mitigation is available.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Network segmentation: place Tomcat instances on internal segments and allow inbound HTTP/HTTPS only from trusted reverse proxies or application gateways.
• Virtual patching / WAF: block or challenge partial PUT requests and anomalous path patterns at the edge; tune rules carefully to avoid breaking legitimate traffic.
• Disable the affected feature: turn off PUT (and similar methods) entirely if the application does not need them; remove or restrict any write-enabled servlets or managers.
• Monitoring: alert on PUT methods, unexpected file writes under Tomcat directories, and post-request process or network anomalies; retain relevant access and application logs for investigation.

These steps lower risk but do not replace the official patch. Confirm any temporary configuration changes against the vendor advisory so you do not introduce new issues.

If your data may have been exposed

Vulnerabilities that allow remote code execution or content injection can lead to breaches if exploited. Known ransomware use of this CVE is not documented. If you suspect compromise, isolate affected hosts, preserve logs and disk images, rotate credentials that may have been accessible from the Tomcat process, and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data to check whether related accounts appear in public dumps.