CVE-2026-25854: Open Redirect in Apache Tomcat

An attacker exploiting this Open Redirect vulnerability can craft malicious URLs that, when clicked by a legitimate user, redirect them to a different website controlled by the attacker. This redirection can be subtle, making it difficult for users to detect they are being manipulated. The attacker could then use this redirection to steal credentials through a fake login page (phishing), distribute malware, or perform other malicious actions. The blast radius extends to any user who interacts with a Tomcat application vulnerable to this redirect, and the potential for widespread impact is significant, particularly in environments with high user traffic or sensitive data.

1. Reserved2026-02-06
2. Published2026-04-09
3. Modified2026-04-15
4. EPSS updated2026-04-17

The primary mitigation for CVE-2026-25854 is to upgrade Apache Tomcat to a version that includes the fix, specifically 11.0.20, 10.1.53, or 9.0.116. If an immediate upgrade is not feasible, consider implementing temporary workarounds. These might include implementing strict URL validation and sanitization within your application code to prevent redirection to external domains. Web Application Firewalls (WAFs) can be configured with rules to block suspicious redirects. Monitor Tomcat access logs for unusual redirection patterns. After upgrading, verify the fix by attempting to trigger the redirect with a known malicious URL; the redirection should be blocked or prevented.