---
title: "Tomcat Partial PUT (CVE-2025-24813)"
canonical: https://trickest.com/library/tomcat-rce-check-cve-2025-24813
description: "Point hosts at Tomcat and flag CVE-2025-24813 by version, then confirm with OPTIONS if PUT is advertised. No file write. CISA KEV."
---

# Tomcat Partial PUT (CVE-2025-24813)

## Overview

This workflow finds Apache Tomcat and sorts each host by whether its version falls in the CVE-2025-24813 range. CVE-2025-24813 is partial PUT path-equivalence that can lead to session deserialization. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the Server header or a public error page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). Version flag is first. Hosts in range get a second node that sends OPTIONS and looks for PUT in Allow. It does not PUT a file.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as Tomcat from the Server banner or error page, then compare the version to the CVE-2025-24813 floors in the graph.
3. Confirm only those flagged hosts with an unauthenticated OPTIONS request. It does not PUT a file.
4. Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Tomcat was detected, the version read, the affected flag, and whether OPTIONS advertised PUT.
- **summary.json.** Counts across the list: targets, product hits, affected, confirmed, and errors.

## Integrations

- HTTP. Unauthenticated GET to the product surface and, on flagged hosts only, OPTIONS. No PUT.

## Sample output

The records below are illustrative and do not come from a real run. They show one Tomcat host inside the CVE-2025-24813 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://app.example.com", "product_detected": true, "version": "11.0.2", "affected": true, "confirmed": true, "error": null}
{"target_url": "https://app.example.org", "product_detected": true, "version": "11.0.3", "affected": false, "confirmed": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "confirmed": false, "error": "not_product"}
```

```json
{"cve": "CVE-2025-24813", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which Tomcat versions does this flag?

Tomcat 11.0 before 11.0.3, 10.1 before 10.1.35, and 9.0 before 9.0.99. The compare uses the version the product itself served.

### Does a confirmed row mean a file was written?

No. Confirm only sends OPTIONS and looks for PUT in Allow. It does not PUT a file. A confirmed row means the server advertises PUT.

### Is this check safe on production?

Yes. Fingerprint is read-only GET. Confirm is OPTIONS, only on hosts already in range. It does not log in or write a file.

### Does the check need credentials?

No. It fingerprints the public page the way an external scanner would.

### What is CVE-2025-24813?

Partial PUT path-equivalence on Tomcat that can lead to session deserialization. CISA listed it on KEV after confirmed use. This workflow flags by version, then confirms PUT is advertised, without writing a file.

## Related workflows

- [Jenkins CLI File Read (CVE-2024-23897)](/library/jenkins-path-traversal-check-cve-2024-23897). Reach for it when the next confirm is also a surface check, not a write.
- [Confluence OGNL RCE (CVE-2023-22527)](/library/confluence-rce-check-cve-2023-22527). Reach for it when the next host is a wiki, not Tomcat.
- [Grafana Path Traversal (CVE-2021-43798)](/library/grafana-path-traversal-cve-2021-43798). Reach for it when the next host is a dashboard.

---
_Markdown source of https://trickest.com/library/tomcat-rce-check-cve-2025-24813._