{
  "threat_severity" : "Low",
  "public_date" : "2026-04-09T19:13:13Z",
  "bugzilla" : {
    "description" : "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve",
    "id" : "2457039",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2457039"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-601",
  "details" : [ "Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.\nOther, unsupported versions may also be affected\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.", "A flaw was found in Apache Tomcat. This open redirect vulnerability allows an attacker to redirect a user to an untrusted site. This occurs through the LoadBalancerDrainingValve, which can be exploited to manipulate URL redirection. The primary impact is that users may be unknowingly directed to malicious websites, potentially leading to phishing attacks or other security compromises." ],
  "statement" : "This Low impact vulnerability in Apache Tomcat allows for an open redirect through the LoadBalancerDrainingValve. An attacker could exploit this to redirect users to malicious websites, potentially leading to phishing. This affects Red Hat Enterprise Linux and Red Hat JBoss Web Server when Apache Tomcat is configured with the LoadBalancerDrainingValve.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36790",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "tomcat9-1:9.0.117-2.el10_2"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.2.3",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20406",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.2",
    "package" : "tomcat"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.2 on RHEL 10",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20405",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el10",
    "package" : "jws6-tomcat-0:10.1.49-13.redhat_00011.1.el10jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.2 on RHEL 8",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20405",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el8",
    "package" : "jws6-tomcat-0:10.1.49-13.redhat_00011.1.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.2 on RHEL 9",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20405",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el9",
    "package" : "jws6-tomcat-0:10.1.49-13.redhat_00011.1.el9jws"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat6",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-deps:10.6/pki-servlet-engine",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-servlet-engine",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-25854\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25854\nhttps://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0" ],
  "name" : "CVE-2026-25854",
  "mitigation" : {
    "value" : "To mitigate this vulnerability, disable or remove the LoadBalancerDrainingValve configuration from the server.xml file in your Apache Tomcat installation. This valve is typically configured within a <Host> or <Engine> element. After modifying server.xml, restart the Apache Tomcat service for the changes to take effect. This action may impact load balancing functionality if the valve is actively used for draining connections.",
    "lang" : "en:us"
  },
  "csaw" : false
}