CVE-2025-24813

Apache Tomcat is affected by a path equivalence flaw (CWE-44) in its handling of partial PUT requests, compounded by deserialization of untrusted data (CWE-502). A remote attacker triggers it by sending a crafted partial PUT (a PUT request with a Content-Range header) to a Tomcat instance that has write access enabled on its default servlet, causing uploaded content to be placed or reconstructed incorrectly and potentially leading to deserialization of attacker-controlled data. Successful exploitation can yield remote code execution, disclosure of sensitive information, or injection of malicious content, and CISA notes the flaw can be chained with CVE-2026-34486. Any organization running Apache Tomcat is potentially affected (version ranges were not specified in the provided data), with risk concentrated in deployments that permit PUT uploads and use file-based session persistence in default locations. Exploitation is confirmed in the wild: the CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-01 and EPSS assigns a 99.9% probability of exploitation within 30 days, though no public proof-of-concept is known.

What to do: Apply the vendor mitigation per CISA's required action: upgrade Tomcat to the fixed release identified in Apache's security advisory for this CVE, or, if patching is not immediately possible, disable write access (readonly) on the default servlet/restrict partial PUT and move file-based session storage away from default locations. Federal agencies must follow BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Audit Tomcat instances (including embedded deployments) for write-enabled PUT and file-based session persistence, and consider exposure to chaining with CVE-2026-34486.