Apache Tomcat: a partial PUT upload can lead to remote code execution
Identifiers: CVE-2025-24813 · GHSA-83qj-6fr2-vhqg · CVSS 3.1 9.8 (scored by NVD)
What it is
If Tomcat's default servlet accepts writes, an attacker can upload a crafted session file with a partial PUT request and have the server run their code when it loads it, or read and alter uploaded files. Writes are off by default, but some apps turn them on. It ships inside every Spring Boot web app, and CISA lists it as exploited in real attacks.
On CISA's Known Exploited Vulnerabilities list since April 1, 2025.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 11.0.0-M1, < 11.0.3 >= 10.1.0-M1, < 10.1.35 >= 9.0.0.M1, < 9.0.99 >= 8.5.0, <= 8.5.100 | 11.0.3, 10.1.35, 9.0.99 |
| Maven | org.apache.tomcat:tomcat-catalina | >= 11.0.0-M1, < 11.0.3 >= 10.1.0-M1, < 10.1.35 >= 9.0.0.M1, < 9.0.99 >= 8.5.0, <= 8.5.100 | 11.0.3, 10.1.35, 9.0.99 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade Tomcat to 11.0.3, 10.1.35 or 9.0.99 or later (Spring Boot: raise the Boot version or set tomcat.version). 8.5 gets no fix: move to 9.0 or later. Until then keep the default servlet read-only (readonly=true) and turn off partial PUT (allowPartialPut=false).
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.