CVE-2026-25854 — Apache Tomcat: Occasionally open redirect

Description (CNA)

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Tomcat	affected 11.0.0-M1 through 11.0.18; affected 10.1.0-M1 through 10.1.52; affected 9.0.0.M23 through 9.0.115; affected 8.5.30 through 8.5.100; unaffected 0 through 7.0.109

CWE

CWE-601

References

https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/04/09/21

CISA-ADP

No English description supplied.

No references supplied.