CVE-2026-25854

A flaw was found in Apache Tomcat. This open redirect vulnerability allows an attacker to redirect a user to an untrusted site. This occurs through the LoadBalancerDrainingValve, which can be exploited to manipulate URL redirection. The primary impact is that users may be unknowingly directed to malicious websites, potentially leading to phishing attacks or other security compromises.

This Low impact vulnerability in Apache Tomcat allows for an open redirect through the LoadBalancerDrainingValve. An attacker could exploit this to redirect users to malicious websites, potentially leading to phishing. This affects Red Hat Enterprise Linux and Red Hat JBoss Web Server when Apache Tomcat is configured with the LoadBalancerDrainingValve.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable or remove the LoadBalancerDrainingValve configuration from the server.xml file in your Apache Tomcat installation. This valve is typically configured within a <Host> or <Engine> element. After modifying server.xml, restart the Apache Tomcat service for the changes to take effect. This action may impact load balancing functionality if the valve is actively used for draining connections.