Headline
GHSA-vfww-5hm6-hx2j: Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.
The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2025-55754
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
Low severity GitHub Reviewed Published Oct 27, 2025 to the GitHub Advisory Database • Updated Oct 28, 2025
Package
maven org.apache.tomcat.embed:tomcat-embed-core (Maven)
Affected versions
>= 11.0.0-M1, < 11.0.11
>= 10.1.0-M1, < 10.1.45
>= 9.0.0.40, < 9.0.109
>= 8.5.60, <= 8.5.100
Patched versions
11.0.11
10.1.45
9.0.109
maven org.apache.tomcat:tomcat (Maven)
>= 11.0.0-M1, < 11.0.11
>= 10.1.0-M1, < 10.1.45
>= 9.0.0.40, < 9.0.109
>= 8.5.60, <= 8.5.100
maven org.apache.tomcat:tomcat-catalina (Maven)
>= 11.0.0-M1, < 11.0.11
>= 10.1.0-M1, < 10.1.45
>= 9.0.0.40, < 9.0.109
>= 8.5.60, <= 8.5.100
Published to the GitHub Advisory Database
Oct 27, 2025
Last updated
Oct 28, 2025
Related news
If you use a smartphone, browse the web, or unzip files on your computer, you are in the crosshairs this week. Hackers are currently exploiting critical flaws in the daily software we all rely on—and in some cases, they started attacking before a fix was even ready. Below, we list the urgent updates you need to install right now to stop these active threats. ⚡ Threat of the Week Apple and
Fortinet, Ivanti, and SAP have moved to address critical security flaws in their products that, if successfully exploited, could result in an authentication bypass and code execution. The Fortinet vulnerabilities affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager and relate to a case of improper verification of a cryptographic signature. They are tracked as CVE-2025-59718 and
Cyberattacks are getting smarter and harder to stop. This week, hackers used sneaky tools, tricked trusted systems, and quickly took advantage of new security problems—some just hours after being found. No system was fully safe. From spying and fake job scams to strong ransomware and tricky phishing, the attacks came from all sides. Even encrypted backups and secure areas were put to the test.