CVE-2026-25854
Open Redirect Vulnerability in Apache Tomcat LoadBalancerDrainingValve
Publication date: 2026-04-09
Last updated on: 2026-04-14
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | From 10.1.0 (inc) to 10.1.53 (exc) |
| apache | tomcat | From 11.0.0 (inc) to 11.0.20 (exc) |
| apache | tomcat | From 9.0.1 (inc) to 9.0.116 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an occasional URL redirection to an untrusted site, also known as an 'Open Redirect', found in Apache Tomcat through the LoadBalancerDrainingValve component.
It affects multiple versions of Apache Tomcat, specifically from 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M23 through 9.0.115, and 8.5.30 through 8.5.100.
The issue allows URLs to redirect users to potentially untrusted external sites.
How can this vulnerability impact me? :
This vulnerability can lead to users being redirected to untrusted or malicious websites without their consent.
Such open redirects can be exploited for phishing attacks, where attackers trick users into visiting harmful sites that may steal credentials or distribute malware.
It can also damage the trustworthiness of your web application or service by exposing users to unsafe destinations.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache Tomcat to version 11.0.20, 10.1.53, or 9.0.116, which fix the Open Redirect vulnerability in the LoadBalancerDrainingValve.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the open redirect vulnerability in Apache Tomcat's LoadBalancerDrainingValve affects compliance with common standards and regulations such as GDPR or HIPAA.