By simply sending HTTP requests, attackers can trigger the deserialisation of malicious data in Tomcat's session storage and gain control.

HTTP is the protocol of the Web, and HTTP server software, such as Microsoft's IIS and the open source Apache server, accepts requests from the user's browser and responds by sending back HTML ...

Attack attempts via CVE-2025-24813 are underway, but successful attacks require specific, non-default configurations, ...

Security outfit Wallarm spotted a PoC in the wild The method abuses a deserialization flaw in Apache Tomcat It allows attackers to ... only need one PUT API request to take over the vulnerable server.

IntroductionCVE-2025-24813 was originally published on March 10 with a medium severity score of 5.5, and Apache Tomcat released an update to fix it. On March 12, the first attack was detected in ...