[](https://www.paloaltonetworks.com/)
[](https://unit42.paloaltonetworks.com/)
Menu
* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
English
* [English](https://unit42.paloaltonetworks.com/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/)
* [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/)
* [French](https://unit42.paloaltonetworks.com/fr/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/ "Vulnerabilities")
[Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/)
# Apache Under the Lens: Tomcat's Partial PUT and Camel's Header Hijack
 13 min read
Related Products
[Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")
* 
By:
* [Jun Li](https://unit42.paloaltonetworks.com/author/jun-li/)
* [Qiang Liu](https://unit42.paloaltonetworks.com/author/qiang-liu/)
* [Yiheng An](https://unit42.paloaltonetworks.com/author/yiheng-an/)
* [Haozhe Zhang](https://unit42.paloaltonetworks.com/author/haozhe-zhang/)
* 
Published:July 3, 2025
* 
Categories:
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)
* [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/)
* 
Tags:
* [Apache](https://unit42.paloaltonetworks.com/tag/apache/)
* [CVE-2025-24813](https://unit42.paloaltonetworks.com/tag/cve-2025-24813/)
* [CVE-2025-27636](https://unit42.paloaltonetworks.com/tag/cve-2025-27636/)
* [CVE-2025-29891](https://unit42.paloaltonetworks.com/tag/cve-2025-29891/)
* [Remote Code Execution](https://unit42.paloaltonetworks.com/tag/remote-code-execution/)
* [](https://unit42.paloaltonetworks.com/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/?pdf=download&lg=en&_wpnonce=7052973960 "Click here to download")
* [](https://unit42.paloaltonetworks.com/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/?pdf=print&lg=en&_wpnonce=7052973960 "Click here to print")
Share
* 
* [](mailto:?subject=Apache%20Under%20the%20Lens:%20Tomcat’s%20Partial%20PUT%20and%20Camel’s%20Header%20Hijack&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fapache-cve-2025-24813-cve-2025-27636-cve-2025-29891%2F "Share in email")
* [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fapache-cve-2025-24813-cve-2025-27636-cve-2025-29891%2F "Share in Facebook")
* [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fapache-cve-2025-24813-cve-2025-27636-cve-2025-29891%2F&title=Apache%20Under%20the%20Lens:%20Tomcat’s%20Partial%20PUT%20and%20Camel’s%20Header%20Hijack "Share in LinkedIn")
* [](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fapache-cve-2025-24813-cve-2025-27636-cve-2025-29891%2F&text=Apache%20Under%20the%20Lens:%20Tomcat’s%20Partial%20PUT%20and%20Camel’s%20Header%20Hijack "Share in Twitter")
* [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fapache-cve-2025-24813-cve-2025-27636-cve-2025-29891%2F&ts=markdown "Share in Reddit")
* [](https://mastodon.social/share?text=Apache%20Under%20the%20Lens:%20Tomcat’s%20Partial%20PUT%20and%20Camel’s%20Header%20Hijack%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fapache-cve-2025-24813-cve-2025-27636-cve-2025-29891%2F "Share in Mastodon")
## Executive Summary
In March 2025, Apache disclosed [CVE-2025-24813](https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq), a vulnerability impacting Apache Tomcat. This is a widely used platform that allows Apache web servers to run Java-based web applications. The flaw allows remote code execution, affecting Apache Tomcat versions 9.0.0.M1 to 9.0.98, 10.1.0-M1 to 10.1.34 and 11.0.0-M1 to 11.0.2.
The same month, Apache revealed two additional vulnerabilities in Apache Camel, a message routing middleware framework. These vulnerabilities are [CVE-2025-27636](https://camel.apache.org/security/CVE-2025-27636.html) and [CVE-2025-29891](https://camel.apache.org/security/CVE-2025-29891.html), two flaws that allow remote code execution, affecting Apache Camel versions 4.10.0 to 4.10.1, 4.8.0 to 4.8.4 and 3.10.0 to 3.22.3.
These vulnerabilities are significant because millions of developers rely on the platform provided by the Apache Foundation. Successful exploitation of these vulnerabilities can allow attackers to execute arbitrary code with Tomcat/Camel privileges.
Apache has released patches, and researchers quickly published proof‑of‑concept (PoC) exploits. Scans and probes for vulnerable servers were seen in the wild shortly after the disclosures. We have confirmed the potential for remote code execution from these three vulnerabilities.
Palo Alto Networks blocked 125,856 probes/scans/exploit attempts related to these vulnerabilities in March 2025. We advise organizations to apply patches promptly.
Palo Alto Networks customers are better protected through the following products and services:
* The [Next Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with an [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) subscription can help identify and block the associated traffic
* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) can help blocking OAST domains and known malicious URLs associated with similar exploit activities
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) and the ASM add-on for [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) can identify external-facing Apache Tomcat servers using the "Tomcat Web Server" attack surface rule
If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).
| **Related Unit 42 Topics and Vulnerabilities Discussed** | [**Vulnerabilities**](https://unit42.paloaltonetworks.com/category/vulnerabilities/), **[CVE-2025-24813](https://unit42.paloaltonetworks.com/tag/cve-2025-24813/)** , **[CVE-2025-27636](https://unit42.paloaltonetworks.com/tag/cve-2025-27636/)** , **[CVE-2025-29891](https://unit42.paloaltonetworks.com/tag/cve-2025-29891/)** |
|----------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
## CVE-2025-24813: Apache Tomcat
### Vulnerability Overview
CVE-2025-24813 is a [vulnerability in Apache Tomcat's partial PUT feature](https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq) that can allow attackers to overwrite serialized session files on disk, leading to arbitrary code execution.
This vulnerability arises when Tomcat is configured to persist HTTP session data, because unpatched Tomcat systems improperly handle partial PUT requests containing the Content-Range header.
#### Partial PUT
The term "[partial PUT](https://www.rfc-editor.org/rfc/rfc9110.html#name-partial-put)" refers to an HTTP PUT request that updates only part of a resource instead of replacing it entirely. When supported, partial PUT typically uses the Content-Range header in an HTTP request to specify which part of the resource should be modified.
This allows clients to upload or overwrite resource segments in chunks. Partial PUT can be exploited to perform incremental file uploads, overwrite specific parts of files, or bypass certain security checks if not properly handled.
#### Session Persistence Feature in Apache Tomcat
Apache Tomcat's HTTP session manager includes a session persistence feature. This feature saves session data to a file or database when the server is shut down, and it reloads this cached data when the server is restarted. Session data contains information such as user login status and preferences, and this feature helps preserve a user's session data across server restarts.
Tomcat encodes this saved session data as a stream of bytes using a process called [serialization](https://docs.oracle.com/javase/8/docs/technotes/guides/serialization/index.html) and stores the serialized data in the local file system. It serializes all session attributes stored in the HttpSession object. This includes any data your web application explicitly places in the session using session.setAttribute(). The information is typically stored somewhere under $TOMCAT\_HOME/webapps/ROOT/.
However, the serialized session data is stored in the same directory used by Tomcat's executePartialPut function. Users can craft HTTP requests to control the session ID and the filename of the cached data in this directory. This could allow an attacker to intentionally set the session ID to match the cached filename of malicious code previously saved to the cache. This can result in deserialization of the cached file, triggering the embedded malicious code.
#### Preconditions
The Content-Range header is often used with partial updates. This header indicates the request body contains a portion of the resource rather than the entire resource. If an HTTP PUT request contains a Content-Range header, Tomcat saves the content (body) of the PUT request to the cache location. The following code snippet shows that Tomcat saves the data from an HTTP PUT request that contains content.
if (range != null) { File contentFile = executePartialPut(req, range, path);
|-------|------------------------------------------------------------------------------|
| 1 2 3 | if (range != null) { File contentFile = executePartialPut(req, range, path); |
A vulnerable Tomcat configuration must have two preconditions to exploit this vulnerability:
1. A disabled readonly parameter in the Tomcat configuration file at $TOMCAT\_HOME/conf/web.xml. The section of web.xml that contains a disabled readonly parameter follows.
\ \readonly\ \false\ \ \[end code\] Session persistence is enabled in the Tomcat configuration file at $TOMCAT\_HOME/conf/content.xml. The section of content.xml that demonstrates enabled session persistence follows. \[begin code\] \ \ \
|-------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | \ \readonly\ \false\ \ \[end code\] Session persistence is enabled in the Tomcat configuration file at $TOMCAT\_HOME/conf/content.xml. The section of content.xml that demonstrates enabled session persistence follows. \[begin code\] \ \ \ |
### Exploiting the Vulnerability
We [tested the exploitation of CVE-2025-24813](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-03-14-Testing-CVE-2025-24813.md) in March 2025. Exploiting this vulnerability consists of two steps:
* First, stage the payload by ending it as a file through an HTTP PUT request with content range and a self-defined filename in the URL. This file contains serialized malicious code for later deserialization.
* Next, trigger the exploit by sending an additional HTTP GET request containing a cookie consisting of JSESSIONID= immediately followed by the self-defined filename prefixed by a period. In this case, the cookie line would read Cookie: "JSESSIONID=.*\[filename\]*" as Figure 1 below shows. This will trigger deserialization of the cache to run the malicious code.
 Figure 1. Two steps of the exploit.
#### Step 1: Stage the Serialized Malicious Code
This first step consists of sending a file of serialized malicious code as the body of an HTTP PUT request. Apache Tomcat will cache the malicious code as a session file on the local file system, since the name of the file in the URI ends in .session as Figure 2 shows in the PUT header line.
Figure 2 shows the first step's PUT request with gopan.session as a filename. The format of this HTTP PUT request from the traffic is: PUT /*\[filename\]*.session HTTP/1.1
 Figure 2. Payload in step 1.
#### Step 2: Trigger the Exploit
The second step consists of sending a follow-up HTTP GET request to trigger the exploit and run the malicious code. Figure 3 shows the HTTP GET request with the JSESSIONID cookie value used in the previous step. The format of this cookie is: Cookie: JSESSIONID=.*\[filename\]*
 Figure 3. Exploiting the vulnerability to run the payload previously sent in step 1.
The cookie value for this exploit uses a period (.) before the filename value of the JSESSIONID. This leading period will lead Tomcat to save the session file with the leading dot.
#### Source Code Analysis
##### How Tomcat Caches the PUT Body to a File
As Figure 4 shows, Tomcat first checks if the readonly flag is enabled in the configuration file. If so, Tomcat does not write any code to the cache, including the malicious code.
 Figure 4. Step one: From PUT to write a file.
* If the readonly flag is not enabled, Tomcat will also check the Content‑Range field in the HTTP header
* If the request lacks a Content‑Range header, Tomcat ends the process
* If the request has a Content‑Range header, Tomcat saves the session data from the HTTP PUT request, in this case gopan.session, in two locations as shown in Figure 5
* The first is saved as a normal cache file under $TOMCAT\_HOME/webapps/ROOT/ without the leading period
* The second is saved as a temporary file with a leading period under the work directory at $TOMCAT\_HOME/work/Catalina/localhost/ROOT/
 Figure 5. Cached session file.
Crucially, when Tomcat restores a session, it also loads the cached session file from the same work folder.
Figures 6 and 7 show code segments from the default Java servlet that Tomcat uses to load cached session files when restoring a session at java/org/apache/catalina/servlets/DefaultServlet.java. Comments in yellow describe actions taken by the code.
 Figure 6. First code segment from Apache's default Java servlet used by Tomcat.  Figure 7. Second code segment from Apache's default Java servlet used by Tomcat.
##### How the Vulnerability Is Triggered by an HTTP Request
When Tomcat receives an HTTP request with a session ID, if session persistence is enabled in the configuration, [it will try to find the session in memory](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-03-14-Testing-CVE-2025-24813.md). If Tomcat cannot find the session in memory, it restores the session from the saved cache file. At that point, Tomcat deserializes the session file, as shown in Figure 8.
 Figure 8. Step two: From sessionID to deserialization.
Figure 8 illustrates Tomcat's session management flow. The code that locates sessions, loads them from disk and deserializes their contents is implemented in the following files:
* java/org/apache/catalina/session/PersistentManagerBase.java
* java/org/apache/catalina/Store.java
* java/org/apache/catalina/session/FileStore.java
Figure 9 shows a code segment from java/org/apache/catalina/session/PersistentManagerBase.java that directs Tomcat to find a file for the session data, if the session data is not available in memory.
 Figure 9. Code segment from PersistentManagerBase.java to find session data as a file if not in memory.
Figures 10 and 11 show code segments from the same PersistentManagerBase.java file that illustrate how it loads the session data from a saved cache file.
 Figure 10. Code segment from PersistentManagerBase.java to load session from file (1 of 2).  Figure 11. Code segment from PersistentManagerBase.java to load session from file (2 of 2).
As Figure 11 shows, store.load(id) triggers deserialization, awakening the malicious code previously embedded in the file by the attacker. This results in arbitrary code execution.
Reviewing this source code first reveals how Tomcat saves session data from an HTTP PUT request, a process by which an attacker can store malicious code. This review also provides insight on how an exploit for the CVE-2025-24813 vulnerability can be triggered by a single follow-up HTTP GET request.
But Tomcat is not the only Apache software that we've seen exploit attempts for in the wild. We have also noted exploit attempts for two vulnerabilities in Apache Camel.
## CVE-2025-27636 and CVE-2025-29891: Apache Camel
### Apache Camel Overview
Apache Camel is an open-source integration framework that allows developers to connect different systems in a reliable and scalable manner. Using Camel, developers can define routing and mediation rules in a variety of domain-specific languages to integrate diverse systems and applications. Apache Camel supports a wide range of protocols and technologies.
Most Camel message handlers are provided as Java packages, allowing the developer to select which packages to include in their product.
### Exploitation Details
Whether encrypted or unencrypted, HTTP is a common method for sending data across the internet. While Camel uses various types of HTTP components like [Jetty](https://camel.apache.org/components/4.10.x/jetty-component.html) and [Netty](https://camel.apache.org/components/4.10.x/netty-component.html), Camel ultimately routes the parsed HTTP messages back to its core components, known as [camel-core](https://camel.apache.org/camel-core/), for further processing.
To facilitate data exchange between Camel and its HTTP components like Jetty and Netty, developers devised a method using key-value pairs to store important contextual information, such as the HTTP response code. Since the HTTP headers are used in processing, Camel also stores the HTTP headers within the same key-value pair. To avoid conflicts between internal contextual information and external data, Camel developers added a Camel prefix to all internal context keys and implemented a filter to prevent the external headers from causing issues (Figure 12).
 Figure 12. Normal HTTP headers compared to Apache Camel HTTP headers.
However, since the filter operates on a case-sensitive basis, an attacker could potentially bypass it by altering the case of the headers.
### Source Code Analysis
By default, Camel registers the default header filter handler. It asks the filter to ignore all header lines that start with Camel, camel and org.apache.camel. The code for this is at components/camel-http-base/src/main/java/org/apache/camel/http/base/HttpHeaderFilterStrategy.java, and Figure 13 shows the applicable segment.
 Figure 13. Code segment from HttpHeaderFilterStrategy.java to ignore specific header lines.
Camel enumerates HTTP request headers, runs the applyFilterToExternalHeaders function and writes the headers to an internal map using components/camel-http-common/src/main/java/org/apache/camel/http/common/DefaultHttpBinding.java as Figure 14 below shows.
 Figure 14. Code segment from DefaultHttpBinding.java.
The header filtering logic does different matches based on Camel's configuration. By default, Camel only uses tryHeaderMatch to only check for the beginning of the header. This is done through core/camel-support/src/main/java/org/apache/camel/support/DefaultHeaderFilterStrategy.java as Figure 15 below shows.
 Figure 15. Code segment from DefaultHeaderFilterStrategy.java showing tryHeaderMatch.
Assuming an attacker overrides the header CAmelExecCommandExecutable using a capital A in the word CAmel, and the developer is using the camel-exec package, camel-exec will read the value and execute it through components/camel-exec/src/main/java/org/apache/camel/component/exec/impl/DefaultExecBinding.java, as Figure 16 below shows.
 Figure 16. Code segment from DefaultExecBinding.java.
If a developer has set this endpoint to execute a benign executable, the attacker can replace the endpoint with a dangerous command, using a reverse shell. The attacker can potentially get a reverse shell through the remote command execution.
## Telemetry
During March 2025, our telemetry had identified 125,856 scans, probes or exploit attempts originating from more than 70 countries for Tomcat vulnerability CVE-2025-24813 and Camel vulnerabilities CVE-2025-27636 and CVE-2025-29891. As our analysis of the trigger data in Figure 17 shows, the frequency of this activity surged immediately after these exploits were announced in mid-March 2025, reaching its peak within the first week.
The data further indicates the presence of both automated scanners and active exploits in the wild.
:chart: Figure 17. Detection of exploit activity in March 2025.
### Exploit Attempt Payloads
We captured payloads that attackers have used so far in these scans, probes and exploit attempts.
Figure 18 shows an example of the initial HTTP PUT request for an exploit attempt of Apache Tomcat vulnerability CVE-2025-24813. This type of activity is a scan or probe to determine if a server is running a vulnerable version of Tomcat.
 Figure 18. HTTP PUT request for exploit of CVE-2025-24813.
If successful, the exploit in Figure 20 results in the victim server attempting to contact an out-of-band application security testing (OAST) server.
Figure 19 shows the HTTP request for an exploit of Apache Camel vulnerability CVE-2025-27636. If successful, this would cause the server to run an echo command. This is a way to test a server running Apache Camel if an attacker already has access and can see the results of an echo command.
 Figure 19. HTTP request from Apache Camel exploit for CVE-2025-27636.
Figure 20 shows the HTTP request for an exploit of Apache Camel vulnerability CVE-2025-29891. Like the exploit attempt for Apache Tomcat shown in Figure 20, this Apache Camel exploit would ask the vulnerable server to contact an OAST server.
 Figure 20. HTTP request from Apache Camel exploit for CVE-2025-29891.
### CVE-2025-24813 Exploit in the Wild
Since we released our coverage for this vulnerability, we have observed 7,859 exploit attempts for the Apache Tomcat vulnerability CVE-2025-24813.
In this section, we analyze this activity from two perspectives: the length of the session name and the value of the Content‑Range header.
#### Tomcat Session Name Length
As noted in our earlier analysis, exploits for CVE-2025-24813 use a name appended by .session in the initial HTTP request. This .session file contains the code the vulnerable host will run if an exploit is successful.
Most of the prefixes in these session names use fewer than 10 characters. Our telemetry reveals that the most common prefixes use six characters as a session name as Figure 21 shows.
 Figure 21. Trends on length of the session name in CVE-2025-24813 exploit attempts.
We noted this pattern length of six characters in more than 6,000 detections. Why would the vast majority of this exploit activity use a session name with a six-character string? This activity pattern correlates with the Content-Range header.
#### Tomcat Content-Range Header
As noted in our Tomcat source code analysis for CVE-2025-24813, the HTTP header for Content-Range is an important factor in this vulnerability. Figure 22 groups the different Content-Range values.
 Figure 22. Trends on Content-Range values seen in CVE-2025-24813 exploit attempts.
Our telemetry reveals we noted the header Content-Range: bytes 0-452/457 in more than 6,000 detections. This finding correlates with the six-character session name.
These two findings match the pattern of a [CVE-2025-24813 template](https://github.com/projectdiscovery/nuclei-templates/blob/99289657b8d7c150b1c716d43fc0458daff2bbbb/http/cves/2025/CVE-2025-24813.yaml#L54) for the [Nuclei Scanner](https://github.com/projectdiscovery/nuclei) by ProjectDiscovery available on GitHub. Figure 23 highlights the correlation with our findings.
 Figure 23. Segment from the CVE-2025-24813 template in the [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates/blob/99289657b8d7c150b1c716d43fc0458daff2bbbb/http/cves/2025/CVE-2025-24813.yaml#L54) GitHub repository.
This means that a large number of the CVE-2025-24813 scans we've seen so far have used the Nuclei Scanner. This makes sense, since Nuclei is a freely available scanner under the MIT license that anyone can use. Both attackers and defenders would likely use this scanner and template to check for the vulnerability.
## Conclusion
Vulnerable Apache Tomcat instances that allow write directory (disabled by default) and partial PUT (enabled by default) are vulnerable to CVE-2025-24813. Vulnerable Apache Camel instances that use specific components are vulnerable to CVE-2025-27636 and CVE-2025-29891.
These vulnerabilities present a significant security risk due to their critical flaws. Attackers can exploit them through specifically crafted HTTP requests.
Such exploits not only enable potential remote code execution, but they also pose broader threats such as data breaches and lateral movement within the network. The use of Nuclei Scanner to check for this vulnerability underscores the ease with which less-skilled adversaries can leverage these vulnerabilities, making immediate action crucial.
### Palo Alto Networks Protection and Mitigation
Palo Alto Networks customers are better protected from the threats discussed above through the following products:
* The [Next Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with an [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) subscription can identify and block the associated traffic, when following best practices, via the following Threat Prevention signature: [96315](https://threatvault.paloaltonetworks.com/?query=96315)
* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) can help blocking OAST domains and known malicious URLs associated with similar exploit activities
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) and the ASM add-on for [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) can identify external-facing Apache Tomcat servers using the "Tomcat Web Server" attack surface rule. Customers can also view their potentially impacted assets through the Threat Response Center.
If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:
* North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
* UK: +44.20.3743.3660
* Europe and Middle East: +31.20.299.3130
* Asia: +65.6983.8730
* Japan: +81.50.1790.0200
* Australia: +61.2.4062.7950
* India: 00080005045107
Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).
## Indicators of Compromise
### CVE-2025-24813
#### Source IP addresses seen for CVE-2025-24813
* 54\.193.62\[.\]84
* 96\.113.95\[.\]10
* 209\.189.232\[.\]134
* 162\.241.149\[.\]101
* 167\.172.67\[.\]75
* 100\.65.135\[.\]245
* 138\.197.82\[.\]147
* 123\.16.159\[.\]102
* 193\.53.40\[.\]18
* 91\.208.206\[.\]203
* 212\.56.34\[.\]85
* 195\.164.49\[.\]70
* 185\.91.127\[.\]9
#### Activity**URLs - CVE-2025-24813**
* PUT /qdigu/session
* PUT /UlOLJo.session
#### SHA256 Hash of Payload Samples
* 6a9a0a3f0763a359737da801a48c7a0a7a75d6fa810418216628891893773540
* 6b7912e550c66688c65f8cf8651b638defc4dbeabae5f0f6a23fb20d98333f6b
### CVE-2025-27636, CVE-2025-29891
#### Source IP Addresses Seen for CVE-2025-27636, CVE-2025-29891
* 30\.153.178\[.\]49
* 54\.147.173\[.\]17
* 54\.120.8\[.\]214
* 139\.87.112\[.\]169
* 139\.87.112\[.\]115
* 64\.39.98\[.\]52
* 139\.87.112\[.\]98
* 139\.87.113\[.\]24
* 64\.39.98\[.\]139
* 54\.96.66\[.\]57
* 138\.197.82\[.\]147
* 22\.85.196\[.\]34
* 64\.39.98\[.\]245
* 64\.39.98\[.\]9
* 54\.120.8\[.\]207
* 130\.212.99\[.\]156
* 139\.87.112\[.\]121
* 139\.87.113\[.\]26
#### Activity Headers for CVE-2025-27636, CVE-2025-29891
* CAmelHttpResponseCode
* CAmelExecCommandExecutable
* CAmelExecCommandArgs
* CAmelBeanMethodName
## Additional Resources
* [RFC9110](https://www.rfc-editor.org/rfc/rfc9110.html#name-partial-put) -- RFC Editor
* [Apache Tomcat](https://github.com/apache/tomcat) -- Apache Foundation
* [Apache Camel](https://github.com/apache/camel) -- Apache Foundation
* [Nuclei Templates](https://github.com/projectdiscovery/nuclei-templates/) -- ProjectDiscovery
Back to top
### Tags
* [Apache](https://unit42.paloaltonetworks.com/tag/apache/ "Apache")
* [CVE-2025-24813](https://unit42.paloaltonetworks.com/tag/cve-2025-24813/ "CVE-2025-24813")
* [CVE-2025-27636](https://unit42.paloaltonetworks.com/tag/cve-2025-27636/ "CVE-2025-27636")
* [CVE-2025-29891](https://unit42.paloaltonetworks.com/tag/cve-2025-29891/ "CVE-2025-29891")
* [Remote Code Execution](https://unit42.paloaltonetworks.com/tag/remote-code-execution/ "Remote Code Execution")
[Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Windows Shortcut (LNK) Malware Strategies](https://unit42.paloaltonetworks.com/lnk-malware/ "Windows Shortcut (LNK) Malware Strategies")
### Table of Contents
*
### Related Articles
* [Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution](https://unit42.paloaltonetworks.com/captive-portal-zero-day/ "article - table of contents")
* [VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/ "article - table of contents")
* [Critical Vulnerabilities in Ivanti EPMM Exploited](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/ "article - table of contents")
## Related Vulnerabilities Resources
[Insights](https://unit42.paloaltonetworks.com/category/insights/) August 4, 2026 [#### The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/)
* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")
* [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI")
* [Vulnerability Exploitation](https://unit42.paloaltonetworks.com/tag/vulnerability-exploitation/ "Vulnerability Exploitation")
[Read now ](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 30, 2026 [#### Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/)
* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")
* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")
* [CVEs](https://unit42.paloaltonetworks.com/tag/cves/ "CVEs")
[Read now ](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 17, 2026 [#### Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/)
* [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection")
* [CVE-2025-40947](https://unit42.paloaltonetworks.com/tag/cve-2025-40947/ "CVE-2025-40947")
* [CVE-2025-40948](https://unit42.paloaltonetworks.com/tag/cve-2025-40948/ "CVE-2025-40948")
[Read now ](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ "Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy")
[High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) June 9, 2026 [#### Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/)
* [CVE-2026-0257](https://unit42.paloaltonetworks.com/tag/cve-2026-0257/ "CVE-2026-0257")
* [Vulnerability](https://unit42.paloaltonetworks.com/tag/vulnerability/ "vulnerability")
[Read now ](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ "Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257")
[High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 6, 2026 [#### Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution](https://unit42.paloaltonetworks.com/captive-portal-zero-day/)
* [CVE-2026-0300](https://unit42.paloaltonetworks.com/tag/cve-2026-0300/ "CVE-2026-0300")
* [EarthWorm](https://unit42.paloaltonetworks.com/tag/earthworm/ "EarthWorm")
* [PAN-OS](https://unit42.paloaltonetworks.com/tag/pan-os/ "PAN-OS")
[Read now ](https://unit42.paloaltonetworks.com/captive-portal-zero-day/ "Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution")
[High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 5, 2026 [#### Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/)
* [Containers](https://unit42.paloaltonetworks.com/tag/containers/ "Containers")
* [CVE-2026-31431](https://unit42.paloaltonetworks.com/tag/cve-2026-31431/ "CVE-2026-31431")
* [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/ "Kubernetes")
[Read now ](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 16, 2026 [#### A Deep Dive Into Attempted Exploitation of CVE-2023-33538](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/)
* [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/ "botnet")
* [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection")
* [CVE-2023-33538](https://unit42.paloaltonetworks.com/tag/cve-2023-33538/ "CVE-2023-33538")
[Read now ](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/ "A Deep Dive Into Attempted Exploitation of CVE-2023-33538")
[High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 19, 2026 [#### VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/)
* [Bash](https://unit42.paloaltonetworks.com/tag/bash/ "bash")
* [CVE-2026-1731](https://unit42.paloaltonetworks.com/tag/cve-2026-1731/ "CVE-2026-1731")
* [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell")
[Read now ](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/ "VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)")
[High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 17, 2026 [#### Critical Vulnerabilities in Ivanti EPMM Exploited](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/)
* [CVE-2026-1281](https://unit42.paloaltonetworks.com/tag/cve-2026-1281/ "CVE-2026-1281")
* [CVE-2026-1340](https://unit42.paloaltonetworks.com/tag/cve-2026-1340/ "CVE-2026-1340")
* [Ivanti](https://unit42.paloaltonetworks.com/tag/ivanti/ "Ivanti")
[Read now ](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/ "Critical Vulnerabilities in Ivanti EPMM Exploited")
[Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) January 30, 2026 [#### Privileged File System Vulnerability Present in a SCADA System](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/)
* [CVE-2025-0921](https://unit42.paloaltonetworks.com/tag/cve-2025-0921/ "CVE-2025-0921")
* [Privilege escalation](https://unit42.paloaltonetworks.com/tag/privilege-escalation/ "privilege escalation")
* [SCADA](https://unit42.paloaltonetworks.com/tag/scada/ "SCADA")
[Read now ](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/ "Privileged File System Vulnerability Present in a SCADA System")
* 
* 
 ![Enlarged Image]()
 Get updates from Unit 42
## Peace of mind comes from staying ahead of threats. Subscribe today.
Your Email
Subscribe for email updates to all Unit 42 threat research.
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.
Invalid captcha!
Subscribe  
{#footer} Products and Services
* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)
* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)
* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)
* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)
* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)
* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)
* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)
* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)
* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)
* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)
* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)
* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)
* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)
* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)
* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)
* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)
* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)
* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)
* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)
* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)
* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)
* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)
* [Prisma SASE](https://www.paloaltonetworks.com/sase)
* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)
* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)
* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)
* [Prisma Access](https://www.paloaltonetworks.com/sase/access)
* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)
* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)
* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)
* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)
* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)
* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)
* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)
* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)
* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)
* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)
* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)
* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)
* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)
* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)
* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)
* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)
* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)
* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)
* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)
* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)
* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)
* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)
* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)
* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)
* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)
* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)
* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)
* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)
* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)
* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess)
* [Incident Response](https://www.paloaltonetworks.com/unit42/respond)
* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform)
* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners)
Company
* [About Us](https://www.paloaltonetworks.com/about-us)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)
* [Customers](https://www.paloaltonetworks.com/customers)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)
Popular Links
* [Blog](https://www.paloaltonetworks.com/blog/)
* [Communities](https://www.paloaltonetworks.com/communities)
* [Content Library](https://www.paloaltonetworks.com/resources)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)
* [Sitemap](https://www.paloaltonetworks.com/sitemap)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)
* [Documents](https://www.paloaltonetworks.com/legal)
Copyright © 2026 Palo Alto Networks. All Rights Reserved
* [](https://www.youtube.com/user/paloaltonetworks)
* [](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [](https://www.facebook.com/PaloAltoNetworks/)
* [](https://www.linkedin.com/company/palo-alto-networks)
* [](https://twitter.com/PaloAltoNtwks)
* EN
Select your language
   
### Default Heading
Read the article 
Seekbar
 
Volume
