Apache Tomcat CVE-2025-24813 (partial PUT path equivalence, CVSS 9.8, exploited): am I vulnerable and which Tomcat versions fix it?

What it is: CVE-2025-24813 is a flaw in how Apache Tomcat handles partial PUT requests. Under certain non-default settings it lets an unauthenticated attacker read or write sensitive files and, when file-based session persistence is used, run code on the server. Exploitation attempts began within days of disclosure in March 2025, and CISA added it to the Known Exploited Vulnerabilities catalog. Am I affected: - Versions: 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, 9.0.0.M1 to 9.0.98, and 8.5.0 to 8.5.98 / 8.5.100 (8.5.x is end of life). Check with bin/version.sh (version.bat on Windows), the Server Status page, or the version of an embedded Tomcat in your app (Spring Boot: spring-boot-starter-tomcat / tomcat-embed-core in your dependency tree). - The serious impact needs the default servlet to allow writes (readonly set to false in web.xml, which is not the default) plus partial PUT (on by default). Code execution additionally needs Tomcat's file-based session persistence with the default storage location and a deserialization-prone library on the classpath. Most default installs are not exploitable, but upgrade regardless. Fix: 1. Upgrade to Tomcat 11.0.3+, 10.1.35+ or 9.0.99+ (or any later release on those lines); move 8.5 to a supported line. For Spring Boot and other embedded uses, upgrade the framework or override the tomcat-embed-core version. 2. If you can't upgrade right away: make sure the default servlet's readonly parameter is true (the default), and set allowPartialPut to false on the default servlet. After: - Look in the webapps and work directories and the session storage directory for unexpected files (especially uploaded .session files or JSPs), and in access logs for PUT requests from unknown sources. - If you find any, treat the host as compromised: rebuild it and rotate secrets used by the application. Sources: https://tomcat.apache.org/security-10.html https://cyber.gc.ca/en/alerts-advisories/vulnerability-impacting-apache-tomcat-cve-2025-24813 https://www.akamai.com/blog/security-research/march-apache-tomcat-path-equivalence-traffic-detections-mitigations