Apache Tomcat 9.0.0.M1 < 9.0.105

CVE-2025-46701 is an improper case-sensitivity handling flaw (CWE-178) in Apache Tomcat's CGI servlet. By manipulating the letter casing of the pathInfo component of a URI mapped to the CGI servlet, an unauthenticated attacker can bypass security constraints that would normally gate access to CGI resources. The bug spans an enormous version range — 9.0.0.M1 through 9.0.104, plus equivalent ranges in 10.1.x, 11.0.x, and the EOL 8.5.x branch — which is why scanners light up on nearly every unpatched Tomcat instance. Fixed in 9.0.105, 10.1.41, and 11.0.7.

Tenable stamps this Medium (CVSS v3.1 7.3 / CVSS v4.0 6.3). That overstates real-world risk dramatically. Apache's own advisory rates it Low. The decisive fact: the CGI servlet is disabled by default and has been for years. It exists to run legacy Perl/Python/shell scripts behind Tomcat — a pattern that was niche in 2010 and is vanishingly rare in 2026 Java deployments. Even among the ~100K internet-facing Tomcat instances visible on Shodan, the fraction serving CGI endpoints is negligible. The bypass yields partial confidentiality and integrity impact (CVSS C:L/I:L/A:L) — not RCE, not privilege escalation. This is a scan-noise CVE for 99%+ of enterprises.

Why this verdict

• Disabled by default: The CGI servlet must be explicitly enabled in web.xml. It has been off by default across all Tomcat branches for years. CIS Benchmarks for Tomcat explicitly recommend removing it. This single prerequisite eliminates >99% of deployments from the vulnerable population.
• Low blast radius even when exploitable: The CVSS impact is C:L/I:L/A:L — partial read, partial tamper, partial availability. There is no path to RCE, shell access, or privilege escalation. The attacker accesses whatever the CGI script does, bounded by the Tomcat service account.
• Platform friction compounds: The case-sensitivity bypass is most effective on Windows (case-insensitive FS). On Linux — where the majority of Tomcat instances run — the altered-case path simply 404s, making the bug a non-issue on the dominant platform.
• Role multiplier: Tomcat occupies high-value roles (app tier for identity apps, CI/CD frontends, production APIs). However, in those roles the CGI servlet is effectively never enabled — these are Java servlet/Spring deployments. The high-value-role floor does not apply because the vulnerable component (CGI servlet) is architecturally absent from high-value Tomcat deployments. No realistic high-value-role chain succeeds.
• No threat signal: Not on KEV, no campaigns, no public PoC, EPSS at 86th percentile (moderate). Apache themselves rate this Low.

Why not higher?

There is no evidence of exploitation, no public PoC, and the prerequisite (CGI servlet enabled) is absent from default configurations and virtually all modern Tomcat deployments. The impact ceiling is partial — no RCE, no privilege escalation, no data exfiltration path beyond what the CGI script itself exposes. Raising this to MEDIUM would overstate risk for a feature that >99% of defenders don't have enabled.

Why not lower?

The bug is real, the version range is vast, and the EPSS score is not trivial at the 86th percentile. A small number of legacy deployments — particularly Windows-hosted Tomcat instances running CGI scripts for backward compatibility — are genuinely exposed. An IGNORE verdict would be inappropriate because those edge-case environments need to patch. LOW correctly signals backlog-priority remediation.

1. Confirm CGI servlet is disabled — Verify that the cgi servlet definition and cgi servlet-mapping are commented out or absent in $CATALINA_HOME/conf/web.xml and all application-level web.xml files. If CGI is not enabled, you are not vulnerable — document this and close the finding. No mitigation SLA applies at LOW severity.
2. If CGI is enabled: restrict by IP at the reverse proxy — If you genuinely need the CGI servlet, block external access to /cgi-bin/* (or your CGI URL pattern) at the reverse proxy (nginx, Apache httpd, F5) or WAF. This is a compensating control until you can patch within the noisgate remediation SLA for LOW (backlog).
3. Normalize URI case at the WAF/proxy — Configure your WAF or reverse proxy to lowercase-normalize all inbound URI paths before forwarding to Tomcat. This neutralizes the case-manipulation bypass regardless of Tomcat version.
4. Patch to 9.0.105+ — The definitive fix. Roll this into your next scheduled Tomcat maintenance window. At LOW severity, treat as backlog hygiene — no hard deadline, but don't let it rot past your next quarterly patch cycle.

Run on each Tomcat host (Linux/macOS) or from an auditor workstation with SSH access. Requires read access to $CATALINA_HOME. Example: bash check_cve_2025_46701.sh /opt/tomcat. No root needed.

#!/usr/bin/env bash
# check_cve_2025_46701.sh — CVE-2025-46701 exposure check
# Usage: bash check_cve_2025_46701.sh /path/to/catalina_home
# Exit codes: 0 = PATCHED/NOT_VULNERABLE, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:?Usage: $0 /path/to/catalina_home}"
VERSION_FILE="$CATALINA_HOME/lib/catalina.jar"
WEB_XML="$CATALINA_HOME/conf/web.xml"

# --- Detect Tomcat version ---
if [ ! -f "$VERSION_FILE" ]; then
  echo "UNKNOWN — catalina.jar not found at $VERSION_FILE"
  exit 2
fi

VERSION=$(unzip -p "$VERSION_FILE" org/apache/catalina/util/ServerInfo.properties 2>/dev/null \
  | grep '^server.number=' | cut -d= -f2 | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not extract Tomcat version"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# --- Version comparison (9.x branch only) ---
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

PATCHED=0
if [ "$MAJOR" -eq 9 ] && [ "$MINOR" -eq 0 ]; then
  [ "$PATCH" -ge 105 ] && PATCHED=1
elif [ "$MAJOR" -eq 10 ] && [ "$MINOR" -eq 1 ]; then
  [ "$PATCH" -ge 41 ] && PATCHED=1
elif [ "$MAJOR" -eq 11 ]; then
  [ "$MINOR" -gt 0 ] && PATCHED=1
  [ "$MINOR" -eq 0 ] && [ "$PATCH" -ge 7 ] && PATCHED=1
elif [ "$MAJOR" -gt 11 ]; then
  PATCHED=1
fi

# --- Check CGI servlet enablement ---
CGI_ENABLED=0
if [ -f "$WEB_XML" ]; then
  # Look for uncommented cgi servlet-class definition
  if grep -q '<servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class>' "$WEB_XML" 2>/dev/null; then
    # Make sure it's not inside a comment block (rough check)
    if ! grep -B5 'CGIServlet' "$WEB_XML" | grep -q '<!--'; then
      CGI_ENABLED=1
    fi
  fi
fi

# --- Verdict ---
if [ "$PATCHED" -eq 1 ]; then
  echo "PATCHED — Tomcat $VERSION is at or above the fixed version."
  exit 0
elif [ "$CGI_ENABLED" -eq 0 ]; then
  echo "PATCHED — Tomcat $VERSION is below fixed version BUT CGI servlet is not enabled. Not exploitable."
  exit 0
else
  echo "VULNERABLE — Tomcat $VERSION with CGI servlet ENABLED. Patch to 9.0.105+ / 10.1.41+ / 11.0.7+."
  exit 1
fi

Sources

1. Tenable Plugin 237498
2. Apache Tomcat 9.x Security Advisories
3. GitHub Advisory GHSA-h2fw-rfh5-95r3
4. NVD — CVE-2025-46701
5. Rapid7 Vulnerability Database
6. Red Hat CVE Entry
7. Apache Tomcat 9.0 CGI How-To
8. SC Media — Tomcat CGI Servlet Bug