CVE-2026-25854

MediumCVSS 6.1/10Last modified Oct 26, 2026

Description

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	>= 11.0.0-M1, <= 11.0.18; >= 10.1.0-M1, <= 10.1.52; >= 9.0.0.M23, <= 9.0.115; >= 8.5.30, <= 8.5.100

References

https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/09/21Mailing List, Third Party Advisory

Timeline

Published: Apr 9, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-258558.8OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability that allows authenticated users to execute arbitrary comman CVE-2026-258568.8OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that allows authenticated users to execute a CVE-2026-258578.8Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality CVE-2026-258589.1macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an u CVE-2026-258598.8Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potenti CVE-2026-25869.1An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the p CVE-2026-258606.1OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to ex CVE-2026-258615.9QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise us CVE-2026-258637.5Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in CVE-2026-258657.8Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary cod CVE-2026-258667.8MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad CVE-2026-258686.1MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The ap