Blog

Security Research

Detecting and Mitigating Apache Tomcat CVE-2025-24813

Exploitation can result in RCE, severe information leakage, or malicious content injection.

Executive summary

\r\n On March 10, 2025, a path equivalence vulnerability in Apache Tomcat (assigned CVE-2025-24813) was publicly disclosed, along with a patch for it. 

\r\n

\r\n While the vulnerability could allow for RCE, it is considered by Apache to be a moderate severity vulnerability, as it has specific non-default prerequisites to be exploitable.

\r\n

\r\n Shortly after the vulnerability was published, Akamai began seeing initial exploit attempts probing potential servers for this vulnerability.

\r\n

\r\n In this blog post, Akamai researchers provide in-depth details about the vulnerability,  exploitation techniques, and detection strategies.

\r\n

\r\n An Akamai Adaptive Security Engine Rapid Rule is automatically providing protection for Akamai App & API Protector customers . 

\r\n

\r\n We also…