CVE-2025-55668

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-556697.5When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffi CVE-2025-55675.4The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM elem CVE-2025-556706.5On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause the Traffic Management CVE-2025-556718.5Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may CVE-2025-556725.4A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to CVE-2025-556734.3When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload.CVE-2025-556746.5A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker CVE-2025-556756.5Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenti CVE-2025-556765.5Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose informati CVE-2025-556777.8Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.CVE-2025-556787.0Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.CVE-2025-556794.7Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.