StackRadar

CVE-2025-31651

Critical

Advisory

Published 28 Apr 2025In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.040
90th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
69
of 17,781 indexed, latest versions
Container images
73
deployed by those charts
Fix available
3 of 4
affected packages

Apache Tomcat: Bypass of rules in Rewrite Valve

Carried by container images the latest versions of 69 of 17,781 indexed charts deploy, on 73 images.

Affected packageAffected versionsFixed inImages
Apache Tomcatbitnami9.0.809.0.1041
tomcatbitnami9.0.80-19.0.1041
tomcat-embed-coremaven8.5.4, 8.5.11, 8.5.14, 8.5.15+31 more9.0.104, 10.1.40, 11.0.672
tomcat-catalinamaven8.5.38, 8.5.82no fix listed2
OSV records
BIT-tomcat-2025-31651GHSA-ff77-26x5-69cr

Charts affected

69 by stars
ChartLatestAffected imagesRadar Score
nacosygqygq2Verified publisher2.1.101 of 4See more

nacos ygqygq2 2.1.10

1 of the 4 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.20e951a1d07bb
tomcat-embed-core@10.1.39
10.1.40

Open the chart page →

4,983
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
microcks/microcks:0.8.0e3a3e0c67b09
tomcat-embed-core@8.5.34
no fix listed

Open the chart page →

10,732
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
tomcat-embed-core@10.1.34
10.1.40
apache/hertzbeat-collector:1.8.0a2bab1be574c
tomcat-embed-core@10.1.34
10.1.40

Open the chart page →

14,000
flowableflowable-oss7.1.01 of 2See more

flowable flowable-oss 7.1.0

1 of the 2 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
flowable/flowable-rest:7.1.0b7ae287502cd
tomcat-embed-core@10.1.30
10.1.40

Open the chart page →

2,784
rocketmqgin1.1.01 of 2See more

rocketmq gin 1.1.0

1 of the 2 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
apache/rocketmq:4.9.35ac2a4e0f627
tomcat-embed-core@8.5.46
no fix listed

Open the chart page →

9,154
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
tomcat-embed-core@8.5.47
no fix listed

Open the chart page →

10,311
skywalkingkubesphere-testVerified publisher3.1.01 of 4See more

skywalking kubesphere-test 3.1.0

1 of the 4 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
apache/skywalking-ui:8.1.067d50e4deff4
tomcat-embed-core@8.5.29
no fix listed

Open the chart page →

18,042
oesopsmxVerified publisher4.0.324 of 25See more

oes opsmx 4.0.32

4 of the 25 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
tomcat-embed-core@10.1.16
10.1.40
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
tomcat-embed-core@10.1.18
10.1.40
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
tomcat-embed-core@10.1.18
10.1.40
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
tomcat-embed-core@10.1.18
10.1.40

Open the chart page →

107,811
apache-rangerapache-ranger0.1.01 of 2See more

apache-ranger apache-ranger 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
apache/ranger:2.7.076c176e8a0e4
tomcat-embed-core@9.0.98
9.0.104

Open the chart page →

7,740
atlas-cmmsf3k-techVerified publisher0.151.51 of 4See more

atlas-cmms f3k-tech 0.151.5

1 of the 4 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
tomcat-embed-core@10.1.19
10.1.40

Open the chart page →

5,291
supertokensgraphql-hive-subcharts1.0.01 of 1See more

supertokens graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
tomcat-embed-core@8.5.47
no fix listed

Open the chart page →

2,709
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
treskon/portrait:DEV-latest88e813f22347
tomcat-embed-core@10.1.33
10.1.40

Open the chart page →

31,844
seldon-coreseldon0.2.72 of 3See more

seldon-core seldon 0.2.7

2 of the 3 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
seldonio/apife:0.2.7ba81b17f00eb
tomcat-embed-core@8.5.34
no fix listed
seldonio/cluster-manager:0.2.729e362bb1ba2
tomcat-embed-core@8.5.34
no fix listed

Open the chart page →

13,798
airsonic-advancedairsonic-advancedVerified publisher0.3.11 of 1See more

airsonic-advanced airsonic-advanced 0.3.1

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
linuxserver/airsonic-advanced:11.1.4d286a7f55a59
tomcat-embed-core@10.1.28
10.1.40

Open the chart page →

1,748
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
tomcat-embed-core@10.1.17
10.1.40

Open the chart page →

28,131
apache-iotdbapache-iotdb-single-nodeVerified publisher0.1.01 of 1See more

apache-iotdb apache-iotdb-single-node 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
apache/iotdb:0.11.28647309f95d1
tomcat-embed-core@8.5.32
no fix listed

Open the chart page →

5,277
apispringbootHelmapispringboot0.1.01 of 1See more

apispringbootHelm apispringboot 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
rabeh/apibootspring:1.0941007b6946e
tomcat-embed-core@10.1.16
10.1.40

Open the chart page →

6,187
axelor-open-suiteaxelor-open-suiteVerified publisher7.2.581 of 2See more

axelor-open-suite axelor-open-suite 7.2.58

1 of the 2 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
Apache Tomcat@9.0.80
tomcat@9.0.80-1
9.0.104
9.0.104

Open the chart page →

9,722
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-agg:logbc25b152d88e
tomcat-embed-core@10.1.34
10.1.40

Open the chart page →

26,996
event-store-servicechoerodon0.8.01 of 2See more

event-store-service choerodon 0.8.0

1 of the 2 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
choerodon/event-store-service:0.8.03c94c97f6f69
tomcat-embed-core@8.5.14
no fix listed

Open the chart page →

9,808
unificloudnativeapp0.4.21 of 1See more

unifi cloudnativeapp 0.4.2

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
jacobalberty/unifi:5.10.19c409924e2463
tomcat-embed-core@8.5.34
no fix listed

Open the chart page →

22,442
castlemockcnieg2.0.11 of 1See more

castlemock cnieg 2.0.1

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
castlemock/castlemock:latestb7f3f1527ba9
tomcat-embed-core@11.0.5
11.0.6

Open the chart page →

4,578
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
tomcat-embed-core@8.5.31
no fix listed

Open the chart page →

16,860
dadosfake-helmdadosfake-app0.1.01 of 1See more

dadosfake-helm dadosfake-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
javaaurelio/dadosfake_web_springboot:latest8541a3cd021a
tomcat-embed-core@10.1.15
10.1.40

Open the chart page →

2,064
entrypoint-balancereclipse-aeriosVerified publisher1.3.01 of 1See more

entrypoint-balancer eclipse-aerios 1.3.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
eclipseaerios/entrypoint-balancer:1.3.043cd999a008d
tomcat-embed-core@10.1.19
10.1.40

Open the chart page →

2,512
management-portaleclipse-aeriosVerified publisher1.1.01 of 2See more

management-portal eclipse-aerios 1.1.0

1 of the 2 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
eclipseaerios/management-portal-backend:1.2.215fba526a4f8
tomcat-embed-core@10.1.19
10.1.40

Open the chart page →

3,888
fibfibonacci-cluster-appsVerified publisher1.0.03 of 5See more

fib fibonacci-cluster-apps 1.0.0

3 of the 5 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
golenski/fibonacci-msg-relay:1.0.0c863dcb0c513
tomcat-embed-core@10.1.31
10.1.40
golenski/fibonacci-task-manager:2.0.03a2b36df247b
tomcat-embed-core@10.1.31
10.1.40
golenski/fibonacci-worker:2.0.0954caf4aaf6a
tomcat-embed-core@10.1.31
10.1.40

Open the chart page →

16,927
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
tomcat-embed-core@10.1.39
10.1.40

Open the chart page →

7,792
my-chartfleet-web-app0.1.02 of 6See more

my-chart fleet-web-app 0.1.0

2 of the 6 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
tomcat-embed-core@8.5.11
no fix listed
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
tomcat-embed-core@8.5.4
no fix listed

Open the chart page →

24,296
base-depflofree-chartVerified publisher1.0.11 of 1See more

base-dep flofree-chart 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
flofree/base-project:2.1.16b6486c5f81e
tomcat-embed-core@9.0.78
9.0.104

Open the chart page →

2,797
mod-ldpfolio-org0.1.331 of 1See more

mod-ldp folio-org 0.1.33

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
folioci/mod-ldp:latestb55696fd9065
tomcat-embed-core@10.1.19
10.1.40

Open the chart page →

1,938
rocketmqgengxiankun-charts0.3.01 of 1See more

rocketmq gengxiankun-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
apache/rocketmq:5.3.0434d8398f996
tomcat-embed-core@8.5.46
no fix listed

Open the chart page →

4,921
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
tomcat-catalina@8.5.82
tomcat-embed-core@8.5.82
no fix listed
no fix listed

Open the chart page →

15,722
supertokensgraphql-hive1.0.01 of 1See more

supertokens graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
tomcat-embed-core@8.5.47
no fix listed

Open the chart page →

2,709
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
tomcat-embed-core@10.1.39
10.1.40

Open the chart page →

1,417
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
tomcat-embed-core@8.5.32
no fix listed

Open the chart page →

6,451
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
tomcat-embed-core@10.1.34
10.1.40

Open the chart page →

25,017
sys-info-web-env-view-serverhuajuan-helm-charts0.1.11 of 2See more

sys-info-web-env-view-server huajuan-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
huajuan6848/env-view-server:0.0.1-SNAPSHOTa303f3d9f6e0
tomcat-embed-core@10.1.11
10.1.40

Open the chart page →

1,989
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
tomcat-embed-core@8.5.15
no fix listed
ibmcom/microclimate-theia:lateste17bdccc5030
tomcat-embed-core@8.5.15
no fix listed

Open the chart page →

57,669
fpga-operatorinaccelVerified publisher2.8.21 of 7See more

fpga-operator inaccel 2.8.2

1 of the 7 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
tomcat-embed-core@9.0.83
9.0.104

Open the chart page →

5,759
zammad-ldap-syncit-at-mVerified publisher0.6.51 of 1See more

zammad-ldap-sync it-at-m 0.6.5

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
tomcat-embed-core@10.1.34
10.1.40

Open the chart page →

1,345
steamcmd-managerjfwenischVerified publisher0.4.51 of 1See more

steamcmd-manager jfwenisch 0.4.5

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
tomcat-embed-core@10.1.33
10.1.40

Open the chart page →

6,586
webtoolsjfwenischVerified publisher0.1.41 of 1See more

webtools jfwenisch 0.1.4

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/webtools:v0.1.44569cae83c70
tomcat-embed-core@10.1.33
10.1.40

Open the chart page →

6,568
k8sforjavak8sforjava0.1.01 of 1See more

k8sforjava k8sforjava 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
vincentgwzhang/k8sforjava:latesta9139f2cd98f
tomcat-embed-core@10.1.34
10.1.40

Open the chart page →

1,476
tdsfkubebb5.7.01 of 3See more

tdsf kubebb 5.7.0

1 of the 3 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
kubebb/mesh-api:v5.7.0a3879931dfa1
tomcat-embed-core@10.1.12
10.1.40

Open the chart page →

6,490
fpga-operatorkubesphere-stable2.7.41 of 7See more

fpga-operator kubesphere-stable 2.7.4

1 of the 7 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
tomcat-embed-core@9.0.83
9.0.104

Open the chart page →

5,759
stakitkvalitetsitVerified publisher0.3.111 of 3See more

stakit kvalitetsit 0.3.11

1 of the 3 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
kvalitetsit/stakit-backend:0.3.0f0af0ba589af
tomcat-embed-core@10.1.24
10.1.40

Open the chart page →

7,802
komgalinkding0.2.31 of 1See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
gotson/komga:1.22.0ba892ab3e082
tomcat-embed-core@10.1.33
10.1.40

Open the chart page →

3,131
tmdbluiscajl0.2.41 of 1See more

tmdb luiscajl 0.2.4

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
lavandadelpatio/tmdb:latestded9377636e9
tomcat-embed-core@10.1.15
10.1.40

Open the chart page →

2,234
resource-processormicroservices-learningVerified publisher1.2.01 of 1See more

resource-processor microservices-learning 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-31651.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
tomcat-embed-core@10.1.13
10.1.40

Open the chart page →

3,683

Container images carrying it

73 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
opencord/ves-agent:1.0.04187e2a8c918
tomcat-embed-core@8.5.31
no fix listed
1
operaton/operaton:1.0.0-beta-4b35867ffe4d8
tomcat-embed-core@10.1.39
10.1.40
1
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
Apache Tomcat@9.0.80
tomcat@9.0.80-1
9.0.104
9.0.104
1
rabeh/apibootspring:1.0941007b6946e
tomcat-embed-core@10.1.16
10.1.40
1
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
tomcat-embed-core@8.5.11
no fix listed
1
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
tomcat-embed-core@8.5.4
no fix listed
1
seataio/seata-server:latest703b5de7f1a6
tomcat-embed-core@9.0.83
9.0.104
1
seldonio/apife:0.2.7ba81b17f00eb
tomcat-embed-core@8.5.34
no fix listed
1
seldonio/apife:0.3.1eea0d3f578ca
tomcat-embed-core@8.5.34
no fix listed
1
seldonio/cluster-manager:0.2.729e362bb1ba2
tomcat-embed-core@8.5.34
no fix listed
1
sysnet4admin/colosseum-agg:logbc25b152d88e
tomcat-embed-core@10.1.34
10.1.40
1
treskon/portrait:DEV-latest88e813f22347
tomcat-embed-core@10.1.33
10.1.40
1
vincentgwzhang/k8sforjava:latesta9139f2cd98f
tomcat-embed-core@10.1.34
10.1.40
1
zahoriaut/zahori-process:0.1.13351f8a220ed7
tomcat-embed-core@10.1.10
10.1.40
1
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
tomcat-embed-core@10.1.17
10.1.40
1
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
tomcat-embed-core@10.1.34
10.1.40
1
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
tomcat-embed-core@10.1.33
10.1.40
1
ghcr.io/jfwenisch/webtools:v0.1.44569cae83c70
tomcat-embed-core@10.1.33
10.1.40
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
tomcat-embed-core@10.1.16
10.1.40
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
tomcat-embed-core@10.1.18
10.1.40
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
tomcat-embed-core@10.1.18
10.1.40
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
tomcat-embed-core@10.1.18
10.1.40
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
tomcat-embed-core@9.0.83
9.0.104
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.